Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switching Your Site to HTTPS on a Shoestring Budget

css-tricks.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: Switching Your Site to HTTPS on a Shoestring Budget

#31

Post by andrewksl »

apo wrote: post #25

This is where Cloudflare comes in. This is where you lose control over your website: https://blog.cloudflare.com/why-we-terminated-daily-stormer/

I mean, if you intend to kick up enough of a shitstorm to be the only person ever denied service by Cloudflare and then be denied service by Godaddy and Google domains, then I guess this rings true?

For everyone else, I'm thinking the few hours it takes your DNS settings to propagate in the unlikely event you'll even have to is probably a reasonable tradeoff for free.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#32

Post by 0xffff2 »

_asummers wrote: post #20
dom0 wrote: post #16

Earlier quoted context omitted.

> the only downside [is] that there is no good option to enforce HTTPS You also have to use GitLab.

Besides aversion to any particular vendor in general, is there a reason you wouldn't want to use them?

I maintain a couple open source projects on Github that belong to the US Government. Getting them open sourced at all was hard enough. Convincing the powers that be to let me use Gitlab isn't practical.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#33

Post by nickjj »

codingdave wrote: post #28
nickjj wrote: post #26

If anyone is interested in a Let's Encrypt solution but doesn't feel like spending a ton of time figuring it all out, I recently released a course[0] that covers this topic in great detail. The TL;DR is it goes over the entire process of setting up a new server, buying / configuring a domain name and securing your site with Let's Encrypt in an automated way. Production ready configs are included to support nginx and…

OK, but... if you don't already have a server and a domain name set up, why are you looking for a course on Let's Encrypt? Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup? Of course, when I was setting it up, Googling gave me pretty clear instructions, so a course wasn't needed, but depending on the exact server setup people…

Hi,

Most of the course is going over a bunch of common server set ups (1 static site, multiple sites on the same server, reverse proxies) along with going over how Let's Encrypt works and how you can apply it to nginx / Apache.

About 20 minutes out of the 3 hours of content is dedicated to registering a domain name and setting up the server itself.

I added those sections because it makes the course an end to end solution on how to go from "hey, I have my site on my own computer but how the heck do I securely host it on the internet?" to really doing it.

That decision was guided by feedback from existing people who have contacted me and asked for that information specifically.

Lots of people have applied the course's content to their existing set up. That's how most people ended up following along.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#35

Post by _asummers »

0xffff2 wrote: post #32
_asummers wrote: post #20

Earlier quoted context omitted.

Besides aversion to any particular vendor in general, is there a reason you wouldn't want to use them?

I maintain a couple open source projects on Github that belong to the US Government. Getting them open sourced at all was hard enough. Convincing the powers that be to let me use Gitlab isn't practical.

That's very interesting! I wonder if there's anyone at GitLab interested in becoming an approved vendor for the US government/DOD. I also wonder if the code.mil people are interested in getting the ball rolling on that from their end.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#36

Post by giobox »

dijit wrote: post #2

Get SSL from using a thirdparty MITM? Not only do they control your DNS they also control all traffic going to your site, also the connection between you and them is not encrypted. I figured this would be a tutorial for letsencrypt. Cloudflare certainly is an option but it's not one I would recommend for -most- people unless I know why they're opting for SSL. If it's static content then sure- but I don't support clou…

> Also the connection between you and them is not encrypted

While you are right in that cloudflare won't stop you making this questionable design choice if you want, you shouldn't and you don't have to either.

You can still use cloudflare's ssl certificate AND use letsencrypt/ to secure traffic between cloudflare and your server, ensuring SSL end to end (aside from the obvious MITM stuff cloudflare have to do in order to successfully retrieve content from their caches etc). Cloudflare call this configuration "full" encryption, as opposed to the somewhat terribly named "dynamic" setup you are referring to.

This is one aspect of cloudflare I'm not huge on either, given that when users see an SSL padlock they may have a reasonable expectation their input is at least encrypted until it reaches the destination server (again with the cache MITM caveats and so on) but no one is forcing you to use it that way.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#37

Post by nyolfen »

andrewksl wrote: post #31
apo wrote: post #25

This is where Cloudflare comes in. This is where you lose control over your website: https://blog.cloudflare.com/why-we-terminated-daily-stormer/

I mean, if you intend to kick up enough of a shitstorm to be the only person ever denied service by Cloudflare and then be denied service by Godaddy and Google domains, then I guess this rings true? For everyone else, I'm thinking the few hours it takes your DNS settings to propagate in the unlikely event you'll even have to is probably a reasonable tradeoff for free.

> be the only person ever denied service by Cloudflare

...so far

http://www.washingtontimes.com/news/2017/aug/30/cloudflare-p...

this has only just begun

Re: Switching Your Site to HTTPS on a Shoestring Budget

#38

Post by mrkurt »

vtlynch wrote: post #24
demoonkevin wrote: post #22

The problem about the free Cloudflare SSL certificate is that you share it with a lot of other sites, most of then with "strange" purposes...

This is a common concern, but in reality, it does not mean anything. "Sharing" your cert with a weird site is similar as taking the same bus route as someone who is bad. From a security standpoint, there is little to no risk. Worst case scenario one of the other sites is doing something that results in the cert being revoked... and I imagine CloudFlare has a way to just move you (and everyone else) onto another cert…

I dunno, it _mostly_ doesn't mean anything, but the day I discovered my site hostname listed next to phishing and porn sites was the day I didn't want to use CloudFlare's free certs anymore. Sure not many people will see the SANs on a cert, and there's nothing wrong with porn using SSL, I just don't want to cobrand with them. :D

Re: Switching Your Site to HTTPS on a Shoestring Budget

#39

Post by pilsetnieks »

codingdave wrote: post #28
nickjj wrote: post #26

If anyone is interested in a Let's Encrypt solution but doesn't feel like spending a ton of time figuring it all out, I recently released a course[0] that covers this topic in great detail. The TL;DR is it goes over the entire process of setting up a new server, buying / configuring a domain name and securing your site with Let's Encrypt in an automated way. Production ready configs are included to support nginx and…

OK, but... if you don't already have a server and a domain name set up, why are you looking for a course on Let's Encrypt? Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup? Of course, when I was setting it up, Googling gave me pretty clear instructions, so a course wasn't needed, but depending on the exact server setup people…

> Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup?

I think the EFF already got that covered: https://certbot.eff.org

Re: Switching Your Site to HTTPS on a Shoestring Budget

#40

Post by pilsetnieks »

icebraining wrote: post #9
dijit wrote: post #2

Get SSL from using a thirdparty MITM? Not only do they control your DNS they also control all traffic going to your site, also the connection between you and them is not encrypted. I figured this would be a tutorial for letsencrypt. Cloudflare certainly is an option but it's not one I would recommend for -most- people unless I know why they're opting for SSL. If it's static content then sure- but I don't support clou…

Playing Devil's advocate: when you run your site on any provider, except maybe colo'ing, you're also giving them access to that data, as they could peek into the system's memory . Using Cloudflare is just adding a second provider.

> Using Cloudflare is just adding a second provider.

Thus immediately increasing risk by 100%.

In actuality though, even more - if you use the setup where the connection between you and CF is not encrypted. In that case any hop along the way between you and CF could intercept the data.

Post reply on HN