Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL now available for Tumblr blogs with custom domains

security.tumblr.com

Post reply on HN
Print view View original

1–10 of 20 posts

Re: SSL now available for Tumblr blogs with custom domains

#3

Post by captn3m0 »

davidpelayo wrote: post #2

How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?

Most browsers will give a mixed-content warning, but still serve images.

Edit: found a reference[0] on the tumblr help site:

>Keep in mind that enabling the option for a theme that wasn’t developed to support SSL may cause “mixed content” errors. If your blog looks weird after you turn SSL on, some resources that the theme needs to render itself may not be getting loaded.

>If you're a theme developer and you'd like to ensure your themes support SSL, make sure that any externally hosted resources such as Cascading Style Sheets (CSS) or Javascript files are served either using HTTPS or a protocol-relative URL. If these files aren’t available over HTTPS, consider uploading them at the Theme Customization page (In your blog settings, click “Edit HTML” and then “Theme assets”).

[0]: https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encry...

Re: SSL now available for Tumblr blogs with custom domains

#4

Post by rsynnott »

davidpelayo wrote: post #2

How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?

Does Tumblr actually allow the embedding of arbitrary images? I've never knowingly seen a Tumblr blog embed external ones; they always seem to be Tumblr-hosted.

Re: SSL now available for Tumblr blogs with custom domains

#5

Post by ameliaquining »

rsynnott wrote: post #4
davidpelayo wrote: post #2

How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?

Does Tumblr actually allow the embedding of arbitrary images? I've never knowingly seen a Tumblr blog embed external ones; they always seem to be Tumblr-hosted.

Yes, Tumblr themes can contain arbitrary HTML. Letting Tumblr host theme assets is generally the easiest way to make them available though.

Re: SSL now available for Tumblr blogs with custom domains

#6

Post by sideproject »

How would one achieve this using LetsEncrypt?

I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt.

There was a post awhile back that explained how Etsy does it (https://codeascraft.com/2017/01/31/how-etsy-manages-https-an...)

But it was wwaayy too much for a small startup like me.

I can think of a manual way of course.

Re: SSL now available for Tumblr blogs with custom domains

#7

Post by j_s »

sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid.

https://caddyserver.com/

I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempting to convert the resulting certificate format into something I could take back to IIS.

Those securing custom subdomains are looking forward to January 2018 when wildcard certificates arrive. https://letsencrypt.org/2017/07/06/wildcard-certificates-com...

Re: SSL now available for Tumblr blogs with custom domains

#8

Post by schoen »

sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

Let's Encrypt implements a protocol, or, if you prefer, an API called ACME, which is being standardized at IETF. This allows you to make software-based requests for certificates. You can implement an ACME client or adapt an existing one to make requests for certificates on behalf of your customers.

See

https://letsencrypt.org/docs/integration-guide/

There are a lot of clients, several dozen of them already. There isn't necessarily a client that's specifically oriented toward provider integration, but one of the lightweight clients like acme.sh might be a good fit because it will work well with external scripting.

Post reply on HN