When it's harder to get SSL working than to install debian stable on a machine, I'd say SSL is too hard.
Switch to HTTPS Now, For Free
61–70 of 264 posts
Re: Switch to HTTPS Now, For Free
#62For another point of view...free is what you get http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_sta...
Re: Switch to HTTPS Now, For Free
#63I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…
If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).
Android 2.x also doesn't support SNI.
Re: Switch to HTTPS Now, For Free
#64If browsers got fixed to not freak out on self-signed certificates, this wouldn't even be an issue, HTTPS could be a default.
Re: Switch to HTTPS Now, For Free
#65Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…
SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com
I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544
Re: Switch to HTTPS Now, For Free
#66Summary: obtain a certificate from StartSSL. They provide free certificates as long as it is for an individual, not a company's website. Their process to get a cert is a little more difficult that the competition, but konklone.com provides a nice step-by-step guide.
Re: Switch to HTTPS Now, For Free
#67If browsers got fixed to not freak out on self-signed certificates, this wouldn't even be an issue, HTTPS could be a default.
But how do you distinguish a self-signed certificate from a MITM NSA-signed one?
Re: Switch to HTTPS Now, For Free
#68StartSSL has some complains in the past. See this (paid user, but why would they provide a free SSL ...?)
http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_sta...
Re: Switch to HTTPS Now, For Free
#69I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…
If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).
But then I'd need to support SSL for all domains hosted on the server, and this would mean getting 5 certificates instead of one.
Re: Switch to HTTPS Now, For Free
#70Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…
SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544
Thanks. We also have a step-by-step configuration guide called SSL/TLS Deployment Best Practices. I've just submitted it here:
https://news.ycombinator.com/item?id=6447518