Well I'm glad to hear that you managed to resolve the other issue.

By default, we hide Webmin and Webshell behind Stunnel (aka stunnel4). Stunnel is a super lightweight SSL/TLS proxying tool. Essentially it takes care of the HTTPS, then hands to Webmin (or Webshell). Part of the reason for that is so we can use a single default SSL/TLS cert for all HTTPS traffic on your server. There was also a historical context, but strictly speaking it's not required (at least not for Webmin).

So you have some choices:

• Reconfigure things so they are back to the TurnKey default (behind stunnel); or
• Ensure that Webmin doesn't use Stunnel and serves itself publicly; either via port 10000 (default Webmin port) or 12321 (TurnKey Webmin default port).

If you'd like to use the TurnKey default, then you'll need to turn off SSL/TLS (HTTPS) in Webmin. That is because Stunnel decrypts the traffic already, so only sends vanilla HTTP. As you have Webmin configured to only accept HTTPS, it doesn't understand the traffic it is receiving.

You'll also want to ensure that Webmin is only listening on localhost. The fact that you can connect to Webmin from your PC via port 10000 means that Webmin is listening publicly. That's not what you want if you're using our default config (i.e. behind Stunnel) - especially once you disable HTTPS!

Both of those config changes should be achievable by editing Webmin mini-server config file (/etc/webmin/miniserv.conf). First be sure to stop Webmin (and it's stunnel counterpart).

systemctl stop webmin stunnel4@webmin

Here are the settings you'll want (if they already exist, ensure that the values match, if they don't already exist, add them on a new line):

ssl=
no_ssl2=1
no_ssl3=1
no_tls1=1
no_tls1_1=1
bind=127.0.0.1

Also please be aware that it's best not to edit Linux files with Windows tools (such as Notepad) as that will often cause issues (Windows uses different line end characters by default which makes it hard for some Linux apps to be able to understand). So I recommend just editing the files in place (i.e. via CLI within a SSH session) using tools such as nano (pretty much like Notepad but for Linux CLI) or vim (if you're already a vim user, I don't need to say anymore - other than I suggest installing "proper" vim - TurnKey only includes "vim.tiny" by default). If you're hellbent on using Windows, then I suggest a third party tool which can edit Linux files without mangling them, e.g. Notepad++.

If you use our defaults and want a "proper" HTTPS cert, then please check out our Confconsole tool, particularly the Let's Encrypt integration. That can get you a single CA signed TLS cert that will "just work" for the main webserver, plus Webmin and Webshell.

The other option would be to get Stunnel out of the way and just allow Webmin to serve itself publicly. In that case, you just need to clean up a little config, but basically leave it as it is now. At the least you will at least want to disable Stunnel for Webmin and remove Webmin's custom config that we add (which makes it depend on Stunnel). Do both of those like this:

systemctl disable --now stunnel4@webmin
mv /etc/systemd/system/webmin.service.d /etc/systemd/system/webmin.service.disabled
systemctl daemon-reload
systemctl restart webmin

If you'd rather use the default TurnKey port (12321), then just change these Webmin miniserv.conf values:

port=10000
listen=10000

Instead of '10000', change both of those to whatever port you wish to use (e.g. '12321' as we use by default).

As a final check, see what ports and which interfaces your server is listening on:

netstat -tlnp

On a default TurnKey LAMP based server, it should look something like this:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      620/mariadbd        
tcp        0      0 127.0.0.1:10000         0.0.0.0:*               LISTEN      269038/perl         
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      439/sshd: /usr/sbin 
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1270/master         
tcp        0      0 127.0.0.1:12319         0.0.0.0:*               LISTEN      269036/shellinaboxd 
tcp        0      0 0.0.0.0:12321           0.0.0.0:*               LISTEN      269009/stunnel4     
tcp6       0      0 :::80                   :::*                    LISTEN      445/apache2         
tcp6       0      0 :::22                   :::*                    LISTEN      439/sshd: /usr/sbin 
tcp6       0      0 :::443                  :::*                    LISTEN      445/apache2         
tcp6       0      0 :::12320                :::*                    LISTEN      269007/stunnel4  

In that output, you can see Webmin ('269038/perl ') is listening on '127.0.0.1:10000'; i.e. localhost, port 10000. Stunnel (or at least '269009/stunnel4') is listening publicly on port 12321 (i.e. '0.0.0.0:12321'). I have noticed in my output that one stunnel (actually Webshell's one) is listening on IPv6 (which also implies that it's still also listening via IPv4), but Webmin's only appears to be listening on IPv4? TBH, I have no idea why that is... I may need to do some more investigation there...