Topic: SSL now enabled on forum - https://www.wxforum.net/

[saratogaWX]

You can change your bookmarks to use https://www.wxforum.net/ now.  The basic site is https compliant.

If you have Show Avatars, Show Signatures enabled, some pages may have http:// links to images so the 'Green Padlock' in the browser turns yellow with a ! symbol to indicate mixed https/http content on the page.  Not all the member sites have converted to https yet, so that issue will be around for a while.

Best regards,
Ken

[Jáchym]

 

[vreihen]

+2 on the     

Can you set the web server for mandatory HTTPS, where it rewrites all non-SSL URL's to their SSL equivalent?????

[saratogaWX]

All the URLs native to WXForum.net automatically use HTTPS for access if the forum is accessed with https://

The parts that return 'mixed' are based on member supplied URLs for Avatars and Signature images, and not all the member sites have HTTPS enabled, so I'm loathe to force a rewrite of *all* URLs supplied by HTML in the forum pages.  I've updated my Signature to use HTTPS for my banner image, and hope that others who have HTTPS available, will do the same .. forcing the conversion would just 'break' a bunch of the images (all offsite  [img]http://...[/img] imbeds, for example).

[chief-david]

Mine is one that is not HTTPS

I will need help in setting that up. Any suggestions are appreciated.

[saratogaWX]

Many of the shared hosters (1and1, GoDaddy, Hostgator, Dreamhost, etc) now offer free LetsEncrypt SSL certificates as a 1-click kind of install.  I used it on my site(s) at 1and1 and Dreamhost.

If you run your own server, the process is a bit more complex, but you can use LetsEncrypt.org directions to get a certificate and install it on the webserver for all domains hosted on the server.  See https://letsencrypt.org/ for details

[Jáchym]

Very good choice Ken...

actually... just since today...

https://blog.mozilla.org/blog/2017/03/07/lots-new-in-firefox-game-changing-webassembly-support/

To help keep you safer on the internet, we’re building upon Firefox’s new warning in the address bar. Firefox now shows an in-context alert if you click into a username or password field on a page that isn’t encrypted with HTTPS.

I wish my provider offered this, but they have no built-in solutoin and do not support letsencrypt...

[WeatherHost]

Why?

There's nothing here that needs to be 'secure'.  It's all jibber-jabber.

[chief-david]

I will send the school this and see what they want to do. It sounds like my website is about the only thing truly hosted in house anymore.  Everything else we do is hosted by someone else. email, student apps, school website.

[weatherc]

Been running Letsencrypt for a while now. It is just coming to its second update-round. 

.mozilla.org/blog/2017/03/07/lots-new-in-firefox-game-changing-webassembly-support/

Next step is blocking forms completely on un-secure sites... 

[chief-david]

I emailed them to get the ball rolling. Looks like there is time-but I do not control the server. Just what is on it in my server space.

[PaulMy]

Many of the shared hosters (1and1, GoDaddy, Hostgator, Dreamhost, etc) now offer free LetsEncrypt SSL certificates as a 1-click kind of install.  I used it on my site(s) at 1and1 and Dreamhost.

If you run your own server, the process is a bit more complex, but you can use LetsEncrypt.org directions to get a certificate and install it on the webserver for all domains hosted on the server.  See https://letsencrypt.org/ for details

I called GoDaddy and the tech support was not familiar with the free LetsEncrypt SSL and basically offered either their standard SLL package at $69 year, or a bit less if 2 or more years, and their deluxe premium package with the green stamp logo, https, etc. at $149.99 ($99.99 on a 2 year plan) on top of my Deluxe hosting plan, oh, and a 1M$ insurance is included with the premium package.

Unfortunately I know virtually nothing about SSL.  What do I gain by upgrading, or what else should I be looking at?

Thanks,
Paul

[saratogaWX]

Paul,
I wouldn't spend money to GoDaddy for their cert.. the gougers may decide (with multiple requests) to offer Shared cPanel websites with letsencrypt certs for free (to remain competitive the 1and1, Dreamhost, etc) and use the 'sold' certs for their business customers who want a more authoritative cert for their operation.

With current versions of Chrome and Firefox, the indicator in front of the http:// URL to your site may note 'Site is not secure' and you get a opened padlock icon.  Not the end of the world (yet).  With WXforum.net via https://, you'll get the locked padlock w/yellow triangle indicating "Parts of this page are not secure (such as images)" when browsing a forum topic.. this is due to the image links in Signatures (and some Avatars) using http:// for access.

[Jáchym]

With current versions of Chrome and Firefox, the indicator in front of the http:// URL to your site may note 'Site is not secure' and you get a opened padlock icon.  Not the end of the world (yet).

... only if the page includes form fields.... so not a big deal (yet)

[ALITTLEweird1]

Ken. I did notice that 1and1 does offer this. But what If I decided to do this, would I have to change every url on my site manually?