Chrome will mark all HTTP sites as ‘not secure’ starting in July

#1

Post by Sami_Lehtinen » Wed, Jul 11, 2018, 3:52 PM UTC

Chrome will mark all HTTP sites as ‘not secure’ starting in July
theverge.com

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#2

Post by ksri » Wed, Jul 11, 2018, 4:17 PM UTC

Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#3

Post by marcosdumay » Wed, Jul 11, 2018, 4:20 PM UTC

ksri wrote: post #2

Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?

Adding a CA to the local register. Or simply registering one on the browser.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#4

Post by BrowncoatShadow » Wed, Jul 11, 2018, 4:56 PM UTC

ksri wrote: post #2

Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?

https://github.com/FiloSottile/mkcert

Still self-signed, but generates a CA that gets added to your browser. It is all pretty seamless.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#5

Post by stefan_ » Wed, Jul 11, 2018, 4:56 PM UTC

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#6

Post by [deleted] » Wed, Jul 11, 2018, 5:00 PM UTC

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

[deleted]

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#7

Post by wildpeaks » Wed, Jul 11, 2018, 5:02 PM UTC

If you wonder how to get HTTPS for your local virtual hosts:

1. create a local CA

2. create a certificate using that local CA

3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it).

Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#8

Post by bowlich » Wed, Jul 11, 2018, 5:04 PM UTC

Because my statically generated blog really needs https.

This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#9

Post by robin_reala » Wed, Jul 11, 2018, 5:05 PM UTC

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#10

Post by craftyguy » Wed, Jul 11, 2018, 5:06 PM UTC

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.