Author Topic: SSL now enabled on forum - https://www.wxforum.net/  (Read 18331 times)

0 Members and 1 Guest are viewing this topic.

Offline saratogaWX

  • Administrator
  • Forecaster
  • *****
  • Posts: 9603
  • Saratoga, CA, USA Weather - free PHP scripts
    • Saratoga-Weather.org
SSL now enabled on forum - https://www.wxforum.net/
« on: March 08, 2017, 07:49:23 PM »
You can change your bookmarks to use https://www.wxforum.net/ now.  The basic site is https compliant.

If you have Show Avatars, Show Signatures enabled, some pages may have http:// links to images so the 'Green Padlock' in the browser turns yellow with a ! symbol to indicate mixed https/http content on the page.  Not all the member sites have converted to https yet, so that issue will be around for a while.

Best regards,
Ken
Ken True/Saratoga, CA, USA main site: saratoga-weather.org
Davis VP1+ FARS, Blitzortung RED, GRLevel3, WD, WL, VWS, Cumulus, Meteobridge
Free weather PHP scripts/website templates - update notifications on Twitter saratogaWXPHP

Offline Jáchym

  • Meteotemplate Developer
  • Forecaster
  • *****
  • Posts: 8605
    • Meteotemplate
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #1 on: March 08, 2017, 07:51:08 PM »
 \:D/ \:D/ =D> =D>

Offline vreihen

  • El Niño chaser
  • Forecaster
  • *****
  • Posts: 1216
  • K2BIG
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #2 on: March 14, 2017, 10:56:46 AM »
+2 on the  =D>  =D>  =D>

Can you set the web server for mandatory HTTPS, where it rewrites all non-SSL URL's to their SSL equivalent?????
WU Gold Stars for everyone! :lol:

Offline saratogaWX

  • Administrator
  • Forecaster
  • *****
  • Posts: 9603
  • Saratoga, CA, USA Weather - free PHP scripts
    • Saratoga-Weather.org
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #3 on: March 14, 2017, 11:42:19 AM »
All the URLs native to WXForum.net automatically use HTTPS for access if the forum is accessed with https://

The parts that return 'mixed' are based on member supplied URLs for Avatars and Signature images, and not all the member sites have HTTPS enabled, so I'm loathe to force a rewrite of *all* URLs supplied by HTML in the forum pages.  I've updated my Signature to use HTTPS for my banner image, and hope that others who have HTTPS available, will do the same .. forcing the conversion would just 'break' a bunch of the images (all offsite  [img]http://...[/img] imbeds, for example).
Ken True/Saratoga, CA, USA main site: saratoga-weather.org
Davis VP1+ FARS, Blitzortung RED, GRLevel3, WD, WL, VWS, Cumulus, Meteobridge
Free weather PHP scripts/website templates - update notifications on Twitter saratogaWXPHP

Offline chief-david

  • Educational Weather
  • Forecaster
  • *****
  • Posts: 2913
  • Space Academy for Educators
    • Benilde-St. Margaret's Weather
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #4 on: March 14, 2017, 12:11:23 PM »
Mine is one that is not HTTPS

I will need help in setting that up. Any suggestions are appreciated.



You can't phase me-I teach Middle School.
It's not you-It's WU.

Offline saratogaWX

  • Administrator
  • Forecaster
  • *****
  • Posts: 9603
  • Saratoga, CA, USA Weather - free PHP scripts
    • Saratoga-Weather.org
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #5 on: March 14, 2017, 12:15:42 PM »
Many of the shared hosters (1and1, GoDaddy, Hostgator, Dreamhost, etc) now offer free LetsEncrypt SSL certificates as a 1-click kind of install.  I used it on my site(s) at 1and1 and Dreamhost.

If you run your own server, the process is a bit more complex, but you can use LetsEncrypt.org directions to get a certificate and install it on the webserver for all domains hosted on the server.  See https://letsencrypt.org/ for details
Ken True/Saratoga, CA, USA main site: saratoga-weather.org
Davis VP1+ FARS, Blitzortung RED, GRLevel3, WD, WL, VWS, Cumulus, Meteobridge
Free weather PHP scripts/website templates - update notifications on Twitter saratogaWXPHP

Offline Jáchym

  • Meteotemplate Developer
  • Forecaster
  • *****
  • Posts: 8605
    • Meteotemplate
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #6 on: March 14, 2017, 12:44:47 PM »
Very good choice Ken...

actually... just since today...

https://blog.mozilla.org/blog/2017/03/07/lots-new-in-firefox-game-changing-webassembly-support/

Quote
To help keep you safer on the internet, we’re building upon Firefox’s new warning in the address bar. Firefox now shows an in-context alert if you click into a username or password field on a page that isn’t encrypted with HTTPS.

I wish my provider offered this, but they have no built-in solutoin and do not support letsencrypt...

Offline WeatherHost

  • Forecaster
  • *****
  • Posts: 3649
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #7 on: March 14, 2017, 01:34:31 PM »
Why?

There's nothing here that needs to be 'secure'.  It's all jibber-jabber.


Offline chief-david

  • Educational Weather
  • Forecaster
  • *****
  • Posts: 2913
  • Space Academy for Educators
    • Benilde-St. Margaret's Weather
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #8 on: March 14, 2017, 01:35:34 PM »
I will send the school this and see what they want to do. It sounds like my website is about the only thing truly hosted in house anymore.  Everything else we do is hosted by someone else. email, student apps, school website.



You can't phase me-I teach Middle School.
It's not you-It's WU.

Offline weatherc

  • Senior Contributor
  • ****
  • Posts: 278
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #9 on: March 14, 2017, 01:37:21 PM »
Been running Letsencrypt for a while now. It is just coming to its second update-round.  :-)

.mozilla.org/blog/2017/03/07/lots-new-in-firefox-game-changing-webassembly-support/

Next step is blocking forms completely on un-secure sites...  :lol:


Offline chief-david

  • Educational Weather
  • Forecaster
  • *****
  • Posts: 2913
  • Space Academy for Educators
    • Benilde-St. Margaret's Weather
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #10 on: March 14, 2017, 03:32:35 PM »
I emailed them to get the ball rolling. Looks like there is time-but I do not control the server. Just what is on it in my server space.



You can't phase me-I teach Middle School.
It's not you-It's WU.

Offline PaulMy

  • Forecaster
  • *****
  • Posts: 5648
    • KomokaWeather
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #11 on: March 14, 2017, 06:32:51 PM »
Many of the shared hosters (1and1, GoDaddy, Hostgator, Dreamhost, etc) now offer free LetsEncrypt SSL certificates as a 1-click kind of install.  I used it on my site(s) at 1and1 and Dreamhost.

If you run your own server, the process is a bit more complex, but you can use LetsEncrypt.org directions to get a certificate and install it on the webserver for all domains hosted on the server.  See https://letsencrypt.org/ for details
I called GoDaddy and the tech support was not familiar with the free LetsEncrypt SSL and basically offered either their standard SLL package at $69 year, or a bit less if 2 or more years, and their deluxe premium package with the green stamp logo, https, etc. at $149.99 ($99.99 on a 2 year plan) on top of my Deluxe hosting plan, oh, and a 1M$ insurance is included with the premium package.

Unfortunately I know virtually nothing about SSL.  What do I gain by upgrading, or what else should I be looking at?

Thanks,
Paul

Offline saratogaWX

  • Administrator
  • Forecaster
  • *****
  • Posts: 9603
  • Saratoga, CA, USA Weather - free PHP scripts
    • Saratoga-Weather.org
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #12 on: March 14, 2017, 07:22:29 PM »
Paul,
I wouldn't spend money to GoDaddy for their cert.. the gougers may decide (with multiple requests) to offer Shared cPanel websites with letsencrypt certs for free (to remain competitive the 1and1, Dreamhost, etc) and use the 'sold' certs for their business customers who want a more authoritative cert for their operation.

With current versions of Chrome and Firefox, the indicator in front of the http:// URL to your site may note 'Site is not secure' and you get a opened padlock icon.  Not the end of the world (yet).  With WXforum.net via https://, you'll get the locked padlock w/yellow triangle indicating "Parts of this page are not secure (such as images)" when browsing a forum topic.. this is due to the image links in Signatures (and some Avatars) using http:// for access.
Ken True/Saratoga, CA, USA main site: saratoga-weather.org
Davis VP1+ FARS, Blitzortung RED, GRLevel3, WD, WL, VWS, Cumulus, Meteobridge
Free weather PHP scripts/website templates - update notifications on Twitter saratogaWXPHP

Offline Jáchym

  • Meteotemplate Developer
  • Forecaster
  • *****
  • Posts: 8605
    • Meteotemplate
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #13 on: March 14, 2017, 08:02:41 PM »
With current versions of Chrome and Firefox, the indicator in front of the http:// URL to your site may note 'Site is not secure' and you get a opened padlock icon.  Not the end of the world (yet).

... only if the page includes form fields.... so not a big deal (yet)

Offline ALITTLEweird1

  • Mark
  • Global Moderator
  • Forecaster
  • *****
  • Posts: 925
    • North Bend Weather
Re: SSL now enabled on forum - https://www.wxforum.net/
« Reply #14 on: March 14, 2017, 08:05:38 PM »
Ken. I did notice that 1and1 does offer this. But what If I decided to do this, would I have to change every url on my site manually?
"Nature can do without man, but man cannot do without nature."


Software: WeatherDisplay
Hardware: Davis VP2 + VP2 Solar + VP2 UV + Lightning Detector + Logitech Webcam + Soil temp + Soil Moisture

 

anything