4 ms·
Bank of England blog: HTTPS only Bank of England primary website: HTTP only They get bonus points for their Let's Encrypt cert and a solid 'A' on SSL Labs (so
by tombrossman 10y ago
Bank of England blog: HTTPS only
Bank of England primary website: HTTP only
They get bonus points for their Let's Encrypt cert and a solid 'A' on SSL Labs (some amusing alt names on the cert though - not their fault and no big deal).
Maybe someone at the bank will realize soon that HTTPS is for more than protecting log-ins, it guarantees the integrity of the page and makes sure the browser displays only and exactly what was sent, with no tampering in transit.
- corin_ 10y agoThey just chose to have a hosted blog from Wordpress with a custom domain, Wordpress chose to use a Let's Encrypt certificate and to lump a bunch of different customers' custom domains into one certificate request hence the alt names.
- oarsinsync 10y agoLots of sites using the same private key. Could this be potentially problematic?
- corin_ 10y agoI wouldn't think so... Wordpress keeps the private key themselves the customers won't have access to it.
- tombrossman 10y agoNot really, the host is already trusted (as explained in the parent comment). The domain owner is free to obtain a different certificate with a new private key that only they know if they wish. When you choose to use shared hosting you are already delegating plenty of trust so it's reasonable to use the host's private key.
- beejiu 10y agoThis was also the case with GCHQ's website until recently.
- biggio 10y agoBrowser not supported :D https://www.boe-careers.co.uk/OA_HTML/RF.jsp?function_id=14296&resp_id=23350&resp_appl_id=800&security_group_id=0&lang_code=US¶ms=aQhzj2W4CCLRwPqS9WKsL3g9L4-t-7jg8PesrvKQBCBiD5wQ4V4p54l.zGnMeLWR&oas=lf6CiwzDoFJim3TytDxGow. https://www.boe-careers.co.uk/OA_HTML/RF.jsp?function_id=142....
- deleted 10y ago[deleted]