Time for HTTPS?

[Marc J]

Google recently announced that any page that has a form asking for payment details or has a password field in it will be marked in their Chrome browser as not secure, starting January 1st 2017. See: -

Google Online Security Blog - Moving towards a more secure web (https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html)
Come in HTTP, your time is up (http://www.theregister.co.uk/2016/09/08/chrome_to_shame_non_https_sites/)
Chrome to Label Some HTTP Sites ‘Not Secure’ in 2017 (https://threatpost.com/chrome-to-label-some-http-sites-not-secure-in-2017/120452/)

Many MDD member sites have customer login sections. If this is through DJEP they're usually framed, I think, and so might be OK, but I've seen others that use their own forms and those really need to think about installing SSLs to enable HTTPS.

Also, anything requiring Geo-location now requires HTTPS. This probably has less of an impact, unless you're trying to determine where the visitor is, of course.

One plus is that if you do jump to HTTPS, you can then add a payment form (using, for example, Stripe, who insist on an SSL) relatively easily.

[discomobiledj]

I've installed Let's Encrypt on all my domains so if any of my clients need/want it then it's there ready and waiting.

[DJ Jules]

I've installed Let's Encrypt on all my domains so if any of my clients need/want it then it's there ready and waiting.

The major barrier for me is the ability to run multiple HTTPS sites off a single IP. Unfortunately I'm still on a Win2k8 server with IIS 7 so I can't use SNI. How are you doing it?

Julian

[discomobiledj]

The major barrier for me is the ability to run multiple HTTPS sites off a single IP. Unfortunately I'm still on a Win2k8 server with IIS 7 so I can't use SNI. How are you doing it?

Julian

It's all off the same IP but each one is registered against the domain name rather than IP.

[Shaun]

I have a secure payment page using stripe. So things are already setup for HTTPS, thanks to Marc.

[Marc J]

It's all off the same IP but each one is registered against the domain name rather than IP.

SSL cerrts are usually issued against domains. The problem is that, traditionally, each has to be on a unique IP. Until SNI came along - which allows multiple SSLs sharing a single IP. But not every hosting platform supports SNI, nor every browser (although most modern browsers do (https://en.wikipedia.org/wiki/Server_Name_Indication#Support), so that's less of an issue now).

[Marc J]

The major barrier for me is the ability to run multiple HTTPS sites off a single IP. Unfortunately I'm still on a Win2k8 server with IIS 7 so I can't use SNI. How are you doing it?

Installing Let's Encrypt on any windows machine doesn't seem so straightforward. There are instructions at https://www.coderamblings.net/archive/lets-encrypt-how-to-set-up-on-a-windows-server-and-help-make-the-web-a-safer-place/, and the comments there claim to have had success on Windows Server 2008.

You'll still need SNI support if you want them on the same IP, though. And I don't think that's supported in IIS 7, or it is but it's a workaround involving installing Apache (https://www.orderfactory.com/articles/SNI-on-Windows-2008-R2.html).

[Marc J]

I have a secure payment page using stripe. So things are already setup for HTTPS, thanks to Marc.

:beer1::beer1::D

For the record, Shaun's uses a paid SSL cert. I wouldn't recommend using Let's Encrypt for taking credit card details. That's just a personal thing at this point, though, I'm not saying you can't...just that I wouldn't.

[rth_discos]

Let's Encypt seems useful for Google's new "loving SSL" websites requirement.

It's expensive to pay around £40 a year for an SSL certificate for a website that doesn't carry any payment transactions.

Shame TSO Host don't support it, and appear to be avoiding answering whether they will or won't support it.

[Marc J]

Shame TSO Host don't support it, and appear to be avoiding answering whether they will or won't support it.

They're listed on Web Hosting who support Lets Encrypt (https://community.letsencrypt.org/t/web-hosting-who-support-lets-encrypt/6920) under "Waiting/Delayed".

https://twitter.com/tsohost/status/722448514228318208

[rth_discos]

They're listed on Web Hosting who support Lets Encrypt (https://community.letsencrypt.org/t/web-hosting-who-support-lets-encrypt/6920) under "Waiting/Delayed".

https://twitter.com/tsohost/status/722448514228318208

Read through the replies to that Tweet, and they've ignored most communication recently - not quite sure why, they're normally very good. But no sign of them planning to implement it based on their response to tweets.

[DJ Jules]

Installing Let's Encrypt on any windows machine doesn't seem so straightforward. There are instructions at https://www.coderamblings.net/archive/lets-encrypt-how-to-set-up-on-a-windows-server-and-help-make-the-web-a-safer-place/, and the comments there claim to have had success on Windows Server 2008.

You'll still need SNI support if you want them on the same IP, though. And I don't think that's supported in IIS 7, or it is but it's a workaround involving installing Apache (https://www.orderfactory.com/articles/SNI-on-Windows-2008-R2.html).

That's the conclusion I've come to as well. Might be time to push for a server upgrade to Win2k12 (or rationalise my URL's to one domain and put the cert on that).

Julian

[Marc J]

That's the conclusion I've come to as well. Might be time to push for a server upgrade to Win2k12 (or rationalise my URL's to one domain and put the cert on that).

Or switch to Linux hosting? Is there a reason you're sticking with Windows?

[DJ Jules]

Or switch to Linux hosting? Is there a reason you're sticking with Windows?

Custom VBScript website with an SQL database back end packed full of views, functions and stored procs :D I'm pretty much tied to Windows without re-engineering 11 years of website development.

Though admittedly I am going to have to do that at some point as ASP/VBScript is a little dated now...

Julian