8 ms·
Server Side TLS
- serialx 10y agoWorth mentioning https://cipherli.st/ https://cipherli.st/ too. But I think more warning about HSTS is needed, since misconfiguring HSTS will cause the domain to be inaccessible for long periods.
- newman314 10y agoIMO, too many of these websites recommend includeSubdomains as part of the HSTS stanza right out the gate. Personally, I'd deploy HSTS incrementally and wait until such time there is a majority of subdomains that are TLS capable before deploying includeSubDomains. Otherwise, there could likely be some nasty surprises.
- aianus 10y agoYou can't get on the HSTS preload list included with browsers without includeSubDomains.
- newman314 10y agoTo clarify, most of the customers I deal with are enterprise customers and so as such have many internet facing hostnames/domains/subdomains. Arbitrarily enabling includeSubDomains is going to lead to nasty surprises if there is no prior coordination.
- hunter2_ 10y ago> majority I'd argue that all, not most, subdomains must be HTTPS capable (I won't say TLS generally, either; this is only dealing with HTTP). Any that aren't will not be accessible by a user agent that recently (within the max-age) visited the parent domain if it had an HSTS header with that flag.
- hannob 10y agoFor HPKP that's true, for HSTS not really. It may just force you to deploy HTTPS and not go back - which some might say is a good thing :-)
- mdewinter 10y agoI'm behind https://cipherli.st https://cipherli.st, together with some friends. IMHO there is no reason not to have HTTPS everywhere, especially now Let's Encrypt exists. I did think and discuss a lot with people on how 'strong' the page is, and if we might want to change that. The page is targeted at sysadmins who I expect to do at least some research before bluntly copy-pasting config files off somewhere, there are enough warnings on the page.
- BinaryIdiot 10y ago> IMHO there is no reason not to have HTTPS everywhere, especially now Let's Encrypt exists I don't want to disagree with you but I do. I most certainly agree that HTTPS must be everywhere and it's easier than ever before. Where I disagree comes with less experienced developers. I can write a quick PHP / Rails / Node / whatever web server to show some website real fast, deploy by uploading it to a shared hosting package or something fancier like elastic beanstalk, and it's done and up there. Yes it's on HTTP but it's so easy. Now you want to add HTTPS to it? It's not easy. Let's Encrypt makes some aspects of it easier but until the amount of fiction is similar to the process of deploying HTTP you'll never see HTTPS ubiquity in my opinion.
- pg_is_a_butt 10y agoi use let's encrypt on google app engine... it took less than 5 minutes. google could very easily automate it for everyone, but that removes the direct verification between domain owners and certificate authorities. granted, you're already giving up this control when you host with any 3rd party, but the CAs are being reckless if they encourage it.
- okket 10y ago> Now you want to add HTTPS to it? It's not easy. Try Caddy with automatic HTTPS [0] in reverse proxy mode [1]. [0] https://caddyserver.com/docs/automatic-https https://caddyserver.com/docs/automatic-https [1] https://caddyserver.com/docs/proxy https://caddyserver.com/docs/proxy
- 10y ago
- yeukhon 10y agoAgree. I started with extremely low max-age like 120 seconds, and once I am comfortable I change to a larger value like 6 months.
- jvehent 10y agoIf you want to contribute to this page, or the config generator [1] that goes with it, check out its repository on github: https://github.com/mozilla/server-side-tls https://github.com/mozilla/server-side-tls [1] https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
- michaeljsmalley 10y agoI've already used it a few times buddy :)
- magthor 10y agoLately I've just been throwing everything behind Caddy (caddyserver.com) in reverse proxy mode. This is all you need in your Caddyfile to get automatic TLS. It's genius. <hostname> { tls <your email> proxy / localhost:<port> }
- allannienhuis 10y agoThanks for that recommendation - Caddy looks awesome.
- mwpmaybe 10y agoWow, this might actually be good enough / full-featured enough to let me stop copying around my huge HAproxy configuration boilerplate and Ansible roles for every project I spin up. Very cool!
- Erwin 10y agoYou can check your configuration afterwards using this tool: https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ For command line, this his nice: https://github.com/iSECPartners/sslyze https://github.com/iSECPartners/sslyze
- cimnine 10y agoAnother cool util to test/debug HTTPS is https://testssl.sh https://testssl.sh It especially useful in locked-up environments where the server-to-server communication must be TLS, yet both servers are not directly accessible from the 'public' internet.
- z3t4 10y agoFor automation with Nginx and Letsencrypt: https://github.com/Z3TA/letsencrypt-nodejs-nginx https://github.com/Z3TA/letsencrypt-nodejs-nginx
- akerro 10y ago> return 301 https://$host$request_uri; https://$host$request_uri; Don't do this. After I did it, my 3 websites were completely wiped-out from search results. From 3k UU to 20-30UU /day.
- wanda 10y agoDid you also set your website up with Google Webmaster Tools to register the 301?
- akerro 10y agoNo, I don't have google account and was never registered there. I don't want any US corporation or government to spy on my visitors.
- nathancahill 10y agoThat's a hard argument to stand on, considering that your search traffic is coming from Google.
- akerro 10y agoAlso form: bing, baidu, duckduckgo, yahoo. My posts were many times on reddit and in 3 years I've been 4 times on HN with +500 upvotes. Currently 1-3 visitors per day come from search results, 0 or 1 are from google. I use goaccess and piwik.
- pfg 10y agoAny chance this is a tracking issue? You might be losing referer information because of the 301, see [1]. [1]: http://piwik.org/faq/troubleshooting/#faq_51 http://piwik.org/faq/troubleshooting/#faq_51
- webtechgal 10y agoI disagree. A site can get (a decent amount of) traffic from Google even without giving it (Google) the open access to ALL the activity taking place on the site by way of using the Webmaster Tools.