Not sure if asked but, how can I enable HTTPS for my statically hosted Github.io site CNAMEd under my own domain?
Chrome will mark all HTTP sites as ‘not secure’ starting in July
131–140 of 143 posts
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#132Bye bye chrome. You were useful until you started pushing your agenda on everyone
You're kidding right? Its 2018, there is no reason to not use https these days. With lets encrypt its not like its costing you anything.
There can be some reasons. Assume you have a site/blog hosted by a service provider like Wordpress, Medium, Github.io, Blogger, Tumblr or some other local provider. It can be expected at least some of them don't support SSL certificates for custom domains.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#133Earlier quoted context omitted.
But how am I supposed to know if I can trust it if it is the first time I am using it?
DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/
Chrome used to have this. It had DANE support but it was removed.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#134Earlier quoted context omitted.
All modern browsers allow you to import certs into their trust store.
But the UIs for that is actively discouraging people from doing so.
Besides, I believe, the majority of people using router config page wouldn't even know for sure what 'importing certs into their browsers trust store' means or why it should be done and where those certs are etc. There's a ton of consumer-unfriendly terms and concepts, plus, as the parent noted, the UIs are usually discouraging.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#135Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#136Earlier quoted context omitted.
You're kidding right? Its 2018, there is no reason to not use https these days. With lets encrypt its not like its costing you anything.
There can be some reasons. Assume you have a site/blog hosted by a service provider like Wordpress, Medium, Github.io, Blogger, Tumblr or some other local provider. It can be expected at least some of them don't support SSL certificates for custom domains.
time to get a new host then?
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#137Earlier quoted context omitted.
You're kidding right? Its 2018, there is no reason to not use https these days. With lets encrypt its not like its costing you anything.
Time is money. It takes time to set it up.
damn, I should do what you do for a living if five whole minutes costs that much.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#138Earlier quoted context omitted.
Time is money. It takes time to set it up.
damn, I should do what you do for a living if five whole minutes costs that much.
It's easy for people like us to set it up. I've set up Letsencrypt many, many times.
Now, imagine you are Joe Blow hosting his blog on some small web host that barely supports Wordpress. Logging into CPanel is confusing to you. How do you deploy SSL?
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#139Earlier quoted context omitted.
damn, I should do what you do for a living if five whole minutes costs that much.
It's easy for people like us to set it up. I've set up Letsencrypt many, many times. Now, imagine you are Joe Blow hosting his blog on some small web host that barely supports Wordpress. Logging into CPanel is confusing to you. How do you deploy SSL?
that is a fair point.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#140Earlier quoted context omitted.
I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing ! EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)
Maybe it my problem, because I don't understand all my options. But when I spin up a new cloud server built on some image from a cloud provider, I am not sure how I can verify this certificate. How can I verify I am not being Mitm'ed on this new server? Or maybe the cloud provider is dropping the ball in not giving me the fingerprint when I request its creation? But yes, it does seem broken to me.
I don’t quite grasp your question but when you setup an instance, the hosting provider can provide you the SSH fingerprint of the server for you to check the first connection