Switching Your Site to HTTPS on a Shoestring Budget • Hacker News Board

demoonkevin wrote: post #22

The problem about the free Cloudflare SSL certificate is that you share it with a lot of other sites, most of then with "strange" purposes...

This is a common concern, but in reality, it does not mean anything. "Sharing" your cert with a weird site is similar as taking the same bus route as someone who is bad.

From a security standpoint, there is little to no risk. Worst case scenario one of the other sites is doing something that results in the cert being revoked... and I imagine CloudFlare has a way to just move you (and everyone else) onto another cert seamlessly.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#25

Post by apo » Mon, Sep 04, 2017, 4:24 PM UTC

This is where Cloudflare comes in.

This is where you lose control over your website:

https://blog.cloudflare.com/why-we-terminated-daily-stormer/

Re: Switching Your Site to HTTPS on a Shoestring Budget

#26

Post by nickjj » Mon, Sep 04, 2017, 4:29 PM UTC

If anyone is interested in a Let's Encrypt solution but doesn't feel like spending a ton of time figuring it all out, I recently released a course[0] that covers this topic in great detail.

The TL;DR is it goes over the entire process of setting up a new server, buying / configuring a domain name and securing your site with Let's Encrypt in an automated way.

Production ready configs are included to support nginx and Apache running on Ubuntu or CentOS. It will work with any web framework or static site.

[0]: https://httpswithletsencrypt.com/

Re: Switching Your Site to HTTPS on a Shoestring Budget

#27

Post by andy_ppp » Mon, Sep 04, 2017, 4:44 PM UTC

If you are deploying with Docker there's this rather simple letsencrypt setup that I literally just got working:

https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

Just add the environment variables for your container, and the docker compose file from [1] and you're proxying with Let Encrypt SSL support. I encountered a few gotchas so feel free to email if you get stuck.

It really does do some interesting magic but so far seems to work great!

[1] Docker compose file and nginx.tpml here: https://github.com/evertramos/docker-compose-letsencrypt-ngi...

Re: Switching Your Site to HTTPS on a Shoestring Budget

#28

Post by codingdave » Mon, Sep 04, 2017, 4:47 PM UTC

nickjj wrote: post #26

If anyone is interested in a Let's Encrypt solution but doesn't feel like spending a ton of time figuring it all out, I recently released a course[0] that covers this topic in great detail. The TL;DR is it goes over the entire process of setting up a new server, buying / configuring a domain name and securing your site with Let's Encrypt in an automated way. Production ready configs are included to support nginx and…

OK, but... if you don't already have a server and a domain name set up, why are you looking for a course on Let's Encrypt? Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup?

Of course, when I was setting it up, Googling gave me pretty clear instructions, so a course wasn't needed, but depending on the exact server setup people have, maybe some installs are harder than others...

Re: Switching Your Site to HTTPS on a Shoestring Budget

#29

Post by true_religion » Mon, Sep 04, 2017, 4:48 PM UTC

apo wrote: post #25

This is where Cloudflare comes in. This is where you lose control over your website: https://blog.cloudflare.com/why-we-terminated-daily-stormer/

Cloudflare is a dns provider, not a register. You can switch your dns in under 24 hours if there is any issue with them.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#30

Post by vog » Mon, Sep 04, 2017, 4:50 PM UTC

Deathmax wrote: post #7

vog wrote: post #6

Is this meant to be camouflaged advertising for Cloudflare? Why don't they mention Let's Encrypt? It is free and easy to setup.

Probably because the author was hosting on Github Pages, and you don't get to set your own certs.

In that case, they could at least explain why Let's Encrypt was no option for them. Doing that in a half sentence would have been sufficient. But they don't mention Let's Encrypt with a single word, nor any other alternative.