4 ms·
One minor beef with the Let's Encrypt process as showcased here: it lists redirecting HTTP traffic to HTTPS as a 'secure' option. While it's better than leavin
by gmac 11y ago
One minor beef with the Let's Encrypt process as showcased here: it lists redirecting HTTP traffic to HTTPS as a 'secure' option.
While it's better than leaving the traffic as HTTP, it's obviously not ideal from a security perspective, because it allows people to bookmark the HTTP version (or not change their bookmarks that were set up for the HTTP version), and risk being MITMed on every visit.
It would arguably be better to display a notice to say something along the lines of 'this site is now accessible only over HTTPS, so please update your bookmarks'.
- marcosdumay 11y agoA 301 redirect would solve this, but it's just too much for an automatic script to insert a 301 redirect or HSTS headers on the server configuration. That's why I'm planning to move my sites to Letsencrypt's certs, but I have no intention at all of using their client. I can place those settings there, but I'd be pissed of if it placed them.
- asdfaoeu 11y agoHSTS has largely solved what you are referring to.
- gmac 11y agoYes — I wonder if Let's Encrypt sets this up by default.
- LunaSea 11y agoIsn't set HSTS at the web application level rather than the SSL / TLS certificate registrar level ?
- bjacobel 11y agoCorrect, HSTS is a header that is passed by nginx/Apache/whatever combined with a hard coded list shipped with your browser. You need SSL for HSTS to work, but the SSL vendor you choose doesn't have any bearing on being able to implement HSTS.
- schoen 11y agoA feature that we were considering is enabling HSTS (in the Secure mode) and gradually increasing the max-age over time, so that if something went wrong at the outset the administrator would be able to reverse the process without affecting clients for very long (perhaps starting with a one hour max-age, then doubling the max-age on every subsequent day?).
- deleted 11y ago[deleted]