Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switching Your Site to HTTPS on a Shoestring Budget

css-tricks.com

Post reply on HN
Print view View original

51–60 of 63 posts

Re: Switching Your Site to HTTPS on a Shoestring Budget

#51

Post by ameliaquining »

NightlyDev wrote: post #44

A better title would be "Serving a GitHub page on HTTPS...". This is far from a proper and secure setup. The whole point of TLS is to ensure users are talking to you and not someone else while protecting the data. This accomplishes neither.

What's the problem? You have to trust Cloudflare, but that's no different from having to trust GitHub. Cloudflare's "Flexible SSL" option does have the problem that the connection between Cloudflare and GitHub is not secure, but this tutorial doesn't recommend that; instead, it recommends a setup wherein Cloudflare validates the *.github.io certificate, so the full path is authenticated.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#52

Post by abalone »

nyolfen wrote: post #37
andrewksl wrote: post #31

Earlier quoted context omitted.

I mean, if you intend to kick up enough of a shitstorm to be the only person ever denied service by Cloudflare and then be denied service by Godaddy and Google domains, then I guess this rings true? For everyone else, I'm thinking the few hours it takes your DNS settings to propagate in the unlikely event you'll even have to is probably a reasonable tradeoff for free.

> be the only person ever denied service by Cloudflare ...so far http://www.washingtontimes.com/news/2017/aug/30/cloudflare-p... this has only just begun

It will be interesting to see where that goes in terms of codifying universal standards. "Existing on a list of 'terrorists' managed by certain nation states" is probably too politically biased. Case in point, the U.N. has passed many resolutions condemning Israel's aggression and violence against civilians. Also you could argue the U.S. drone assassination program induces terror in populations, just as China flying killer drones over San Francisco would to us. Even if they only meant to target, say, violent Neo-Nazis. The lack of fair trial, the collateral damage, the hum of the ever-present drones, the idea that you could be wiped out on the street at any moment.. it's terrifying.

If tech companies want to wade into this they would need to codify a standard that applies universally to all violent political actors. And, guess what, this comes up a lot in the U.N. and the militarily powerful nations tend to shy away from anything that might include what they do as "terrorism" or illegal. They tend to prefer blacklists they manage themselves over universal standards.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#55

Post by majewsky »

jloughry wrote: post #48
nickjj wrote: post #42

Earlier quoted context omitted.

certbot works, but I'm not a fan of using it. I'd much rather configure nginx / Apache myself so I know exactly what's happening and can mold the solution to fit whatever use cases I have.

certbot --standalone You'll need to turn off your web server for a minute or two while certbot runs ('standalone' means it starts up a temporary web server of its own and binds to port 80 for a moment) but then it leaves the new certificate for you in a few files in /usr/local/ somewhere, and you proceed to edit the nginix.conf file yourself. It works great.

You don't need to turn off your webserver, you can use `certbot certonly --webroot -w /path/to/docroot ...` where /path/to/docroot points to the document root, i.e. the root directory of the website contents, provided that your webserver is listening on port 80 (HTTP).

On my personal servers, I have the regular webserver configured to listen on port 443 (HTTPS) only, and I have a separate webserver on port 80 that's only used for ACME challenges. All other HTTP requests are immediately upgraded to HTTPS. Among other things, this split solves the cyclic dependency between the webserver not starting without TLS certificates, but also being required to provision certificates.

Details: https://blog.bethselamin.de/posts/how-i-run-certbot.html

Re: Switching Your Site to HTTPS on a Shoestring Budget

#56

Post by marcosdumay »

0xffff2 wrote: post #32
_asummers wrote: post #20

Earlier quoted context omitted.

Besides aversion to any particular vendor in general, is there a reason you wouldn't want to use them?

I maintain a couple open source projects on Github that belong to the US Government. Getting them open sourced at all was hard enough. Convincing the powers that be to let me use Gitlab isn't practical.

I assume the intersection of projects that need a no-budget solution for hosting an https site and projects that belong to the US government is zero.

Am I missing something?

I mean, yes, if you have practical problems that make gitlab harder to use, don't use it. No problem at all. But it is still a perfectly valid solution for the problem the GP was trying to solve.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#57

Post by moneytalks »

vostok wrote: post #11
moneytalks wrote: post #8

Earlier quoted context omitted.

Not to mention that Cloudflare has no tolerance for mocking murdered female protestors. One little article and they kill your site with no warning.

I think there's more to The Daily Stormer than one little article.

Never went to the site, never plan to.

But it was just the one article that the CEO said was the reason for the kill order.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#58

Post by Xoros »

jloughry wrote: post #48
nickjj wrote: post #42

Earlier quoted context omitted.

certbot works, but I'm not a fan of using it. I'd much rather configure nginx / Apache myself so I know exactly what's happening and can mold the solution to fit whatever use cases I have.

certbot --standalone You'll need to turn off your web server for a minute or two while certbot runs ('standalone' means it starts up a temporary web server of its own and binds to port 80 for a moment) but then it leaves the new certificate for you in a few files in /usr/local/ somewhere, and you proceed to edit the nginix.conf file yourself. It works great.

You can also use the dns challenge and not worrying for the web server at all.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#59

Post by tyteen4a03 »

Deathmax wrote: post #7
vog wrote: post #6

Is this meant to be camouflaged advertising for Cloudflare? Why don't they mention Let's Encrypt? It is free and easy to setup.

Probably because the author was hosting on Github Pages, and you don't get to set your own certs.

Both GitLab Pages and Netlify has LE support.

Re: Switching Your Site to HTTPS on a Shoestring Budget

#60

Post by corobo »

mrkurt wrote: post #38
vtlynch wrote: post #24

Earlier quoted context omitted.

This is a common concern, but in reality, it does not mean anything. "Sharing" your cert with a weird site is similar as taking the same bus route as someone who is bad. From a security standpoint, there is little to no risk. Worst case scenario one of the other sites is doing something that results in the cert being revoked... and I imagine CloudFlare has a way to just move you (and everyone else) onto another cert…

I dunno, it _mostly_ doesn't mean anything, but the day I discovered my site hostname listed next to phishing and porn sites was the day I didn't want to use CloudFlare's free certs anymore. Sure not many people will see the SANs on a cert, and there's nothing wrong with porn using SSL, I just don't want to cobrand with them. :D

So pay for the package that doesn't do that
Post reply on HN