Why not mention let's encrypt and caddy?
Switching Your Site to HTTPS on a Shoestring Budget
41–50 of 63 posts
Re: Switching Your Site to HTTPS on a Shoestring Budget
#42Earlier quoted context omitted.
OK, but... if you don't already have a server and a domain name set up, why are you looking for a course on Let's Encrypt? Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup? Of course, when I was setting it up, Googling gave me pretty clear instructions, so a course wasn't needed, but depending on the exact server setup people…
> Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup? I think the EFF already got that covered: https://certbot.eff.org
certbot works, but I'm not a fan of using it.
I'd much rather configure nginx / Apache myself so I know exactly what's happening and can mold the solution to fit whatever use cases I have.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#43Earlier quoted context omitted.
Besides aversion to any particular vendor in general, is there a reason you wouldn't want to use them?
I maintain a couple open source projects on Github that belong to the US Government. Getting them open sourced at all was hard enough. Convincing the powers that be to let me use Gitlab isn't practical.
Open source means the project can be redistributed by any user. So any user, including yourself, can re-host the project on Gitlab.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#44A better title would be "Serving a GitHub page on HTTPS...".
This is far from a proper and secure setup. The whole point of TLS is to ensure users are talking to you and not someone else while protecting the data. This accomplishes neither.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#45Earlier quoted context omitted.
Besides aversion to any particular vendor in general, is there a reason you wouldn't want to use them?
I maintain a couple open source projects on Github that belong to the US Government. Getting them open sourced at all was hard enough. Convincing the powers that be to let me use Gitlab isn't practical.
Couldn't you just fork it yourself on gitlab? Or any random person fork it?
Re: Switching Your Site to HTTPS on a Shoestring Budget
#46I don't think you can get away with using Cloudflare's free SSL.
I tried, and I had no real excuse when some users said it didn't work for their old browsers at work. So I paid the $20/mo which made it work in all browsers and had other features that were useful to me, like on the fly image transcoding for mobile devices.
If you're really on a shoestring budget, I have a hard time justifying shutting down legit users. Just use something else like Lets Encrypt.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#47FYI there is an alternative to Github Pages + Cloudflare if you want to use Let's Encrypt using the same features of Github Pages: Gitlab Pages. It allows you to add your own certificates with the only downside that there is no good option to enforce HTTPS (only workarounds, at least for now; there is a discussion on the matter [1]), if this is a problem for you the solution is (Github|Gitlab|Bitbucket)+Netlify, whic…
> the only downside [is] that there is no good option to enforce HTTPS You also have to use GitLab.
Only for Pages, though. (Disclaimer: I haven't actually tried the following setup myself, since I run my own server.) GitLab supports repository mirroring, so you can keep using GitHub for everything else. When you push code to GitHub, it will be automatically pulled into GitLab and trigger the CI job for Pages, generating and publishing the site.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#48Earlier quoted context omitted.
> Wouldn't the more appropriate use case be to list out the most common server setups, and instruct how to add Let's Encrypt to existing setup? I think the EFF already got that covered: https://certbot.eff.org
certbot works, but I'm not a fan of using it. I'd much rather configure nginx / Apache myself so I know exactly what's happening and can mold the solution to fit whatever use cases I have.
certbot --standalone
You'll need to turn off your web server for a minute or two while certbot runs ('standalone' means it starts up a temporary web server of its own and binds to port 80 for a moment) but then it leaves the new certificate for you in a few files in /usr/local/ somewhere, and you proceed to edit the nginix.conf file yourself. It works great.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#49I don't think you can get away with using Cloudflare's free SSL. I tried, and I had no real excuse when some users said it didn't work for their old browsers at work. So I paid the $20/mo which made it work in all browsers and had other features that were useful to me, like on the fly image transcoding for mobile devices. If you're really on a shoestring budget, I have a hard time justifying shutting down legit users…
The issue you ran into is not specific to Cloudflare; in particular, Let's Encrypt will not help you work around it.
The problem is that ancient (pre-2006) versions of the TLS protocol provided no way for the client to tell the server, before authenticating, which hostname it wanted to talk to. So there could be only one certificate (and therefore, in practice, no more than 100 hostnames) per IP address, which made the use of HTTPS on shared hosting impossible. If you wanted HTTPS, you had to get your own static IP, which is what costs $20 per month (and you can't get it that much cheaper anywhere else).
Server Name Indication is a newer extension to the TLS protocol which solves this problem by letting the client specify, when initiating the negotiation, which hostname it wants to talk to. So HTTPS on shared hosting is now possible...unless you need to support truly ancient clients (most notably Windows XP) that are stuck with outdated TLS implementations that don't support SNI. Considering that XP doesn't even get security fixes anymore, and pretty much all clients newer than Windows Vista support SNI now, and running software that old is really not safe (Vista doesn't get security fixes anymore either), I don't think I'd have any qualms about telling those users that they need to upgrade.
Re: Switching Your Site to HTTPS on a Shoestring Budget
#50A better title would be "Serving a GitHub page on HTTPS...". This is far from a proper and secure setup. The whole point of TLS is to ensure users are talking to you and not someone else while protecting the data. This accomplishes neither.
Welcome to the new world, where https only purpose is to prevent the browser from telling visitors your site is not secure.