Switch to HTTPS Now, For Free
konklone.com
Switch to HTTPS Now, For Free
1–10 of 264 posts
Re: Switch to HTTPS Now, For Free
#2I used this guide to help switch a site to HTTPS just last week. Very useful and super simple.
On issue I did run into (not relevant to the article but anyway) was that Heroku charges $20/month to use SSL on a custom domain.
Re: Switch to HTTPS Now, For Free
#3It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for said dedicated IP before you can set up SSL, generally.
I mean, we're not talking a huge amount of money. Webfaction is $5/month [1]. Still!
Re: Switch to HTTPS Now, For Free
#4Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise?
If not, than this is exactly what we need to establish HTTPS as the new standard.
Re: Switch to HTTPS Now, For Free
#5One gotcha that these kinds of tutorials don't mention is that if your site might be blacklisted if google doesn't say it's been 100% clear of trojans for the past 90 days. I hit this on my domain when I accidentally had an .exe file in my static files. I've had to wait 3 months until I can get the certificate.
http://safebrowsing.clients.google.com/safebrowsing/diagnost...
Re: Switch to HTTPS Now, For Free
#6In the switch to https everywhere, we have barely started. For every HN and wikipedia with https there are 20 websites without (and whether the ones that do https do really secure https is yet another question).
Somebody should go through the top 10k websites and make a list, then repeat every few months.
Re: Switch to HTTPS Now, For Free
#7In the switch to https everywhere, we have barely started. For every HN and wikipedia with https there are 20 websites without (and whether the ones that do https do really secure https is yet another question). Somebody should go through the top 10k websites and make a list, then repeat every few months.
Well, if you go by % of internet traffic Google is 40-50% of all internet traffic. You could probably get above 99% of all internet traffic with a shockingly small number of sites. While Google, for example, uses SSL it's not like your data is really secure from monitoring there.
Re: Switch to HTTPS Now, For Free
#8It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for said dedicated IP before you can set up SSL, generally. I mean, we're not talking a huge amount of money. Webfaction is $5/month [1]. Still! [1]: https://www.webfaction.com/features
You can use StartSSL certificates with SNI (Server Name Indication) which allows you to have multiple sites/domains on the same IP. And really, just get a VPS from Digital Ocean -- be the master of your IP, configuration and fate.
Re: Switch to HTTPS Now, For Free
#9It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for said dedicated IP before you can set up SSL, generally. I mean, we're not talking a huge amount of money. Webfaction is $5/month [1]. Still! [1]: https://www.webfaction.com/features
You can use StartSSL certificates with SNI (Server Name Indication) which allows you to have multiple sites/domains on the same IP. And really, just get a VPS from Digital Ocean -- be the master of your IP, configuration and fate.
Only issue with SNI is that it has to be supported by the browser. Generally not an issue these days, but something to be aware of.
Edit: Actually, I just looked... WinXP still doesn't support it with IE, so, actually it could be a big issue still.
Re: Switch to HTTPS Now, For Free
#10Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.
They work in all modern browsers, they do not work in certain (very) old versions of curl, wget, android etc.[1]
They should be alright for most stuff, especially for personal use.
And they're free because it costs them nothing to issue them.