Topic: SSL

[parsoli]

I use Let's Encrypt.  If you run a Linux server, the process to install and configure takes less than 5 minutes.
If you use any type of WAF (Web Application Firewall), like I do, you then have to export the certs and import into your WAF.  That's another 5 minutes

Most users set up CRON jobs to update their certs every 89 days.  That's probably why those with free certs with hosting plans don't do anything....the hoster updates them for you.

Losing the Asteroid deal is ok to me since it bumps my site up so high.

[lrosenman]

I set up acme.sh (from github) to automate it.  I have all my stuff (web/mail/imap/etc) using one LE cert that a cronjob
updates every 60 days.  It seems to work well.

[yamiacaveman]

I use two different host that I use for different things -- One host provides the SSL and the other is shared -- so the shared one, is of course where my weather site is hosted, and if I use that one it comes up HTTPS but with the host domain first -- like a subdomain so when people click on your domain name it looks like you get thrown to someone else page.

I really don't want to spend extra money, perhaps when the time comes I'll move my weather site to the host that gives me the free cert.

[Bunty]

I use https with Saratoga templates. The switch took place with no issues with added guidance from Suresupport.com. I had a few script urls in which needed the https applied, but mostly just switching or adding the https to your url web pages is where most of my effort was applied.

I can verify it appears to help with search engines. I was like back on page 7 or 9 last summer, however now the website is on page 2 & 3 of google. Other than switching to https, no changes had taken place.

That is certainly a better than average weather website. 

[gwwilk]

After reading about Let's Encrypt's issuance of numerous certificates with 'Paypal' in the name, I decided to go with the more expensive GoDaddy SSL option.  Besides the hit to the wallet it wasn't too difficult to initiate.  I placed a redirect of all traffic to my site to 'https' in .htaccess, and then I discovered that there was a great deal of work that I had to do over the next several days in order to securely display many of my pages by converting 'http://' references to 'https://'.

Unfortunately several NOAA and NWS sites haven't yet adopted SSL as per the federal mandate, so some pages that use iframes to display external NWS loops such as the HAniS satellite loops won't display.  I've put a 'blocked' graphic up on those pages' menu links and placed an explanatory note on the pages themselves, but it's a nuisance, albeit hopefully a temporary one.  I did manage to substitute animated-gif-based loops for a couple of the comprehensive satellite displays, but it's nowhere near as useful as the full regional set of loops.  The Sea Surface Temperature loops are being deprecated in favor of a much more comprehensive set of graphics that will require quite a bit of time to analyze before setting up new loops.

I now display the green padlock on most of my pages, the exceptions being when 'http://' references are needed for the page in which case the 'circle-i' is displayed in the address bar.  In all, I'm not sure the reward has been worth the effort in view of the non-interactive nature of my site where no user date at all is entered.  But I do understand the reasons for the change, and that's why I did so.