6 ms·
Does my site need https?
- otterpro 9y agoI didn't know about Caddy Webserver, andit looks really nice. I will look into replacing nginx, which has become way more complex than I need, for hosting my static generated blog/website.
- dsun179 9y agoMy site is a local webserver listening to localhost. Please give me the free certificate for 127.0.0.1 so I can use webworkers. F*ck you google, I know whats secure for me.
- slobotron 9y agoImport your own CA into the browser?
- zeta0134 9y agoFor local websites, there are a couple of workarounds with Chrome in particular. I think creating a self-signed certificate and then adding it to Chrome should work to enable web-workers, but I haven't tested this. There's a chrome://flags thing to disable some security on localhost, but I don't know if this will enable web workers specifically. Anyway, check out this thread for things to try: https://stackoverflow.com/questions/7580508/getting-chrome-to-accept-self-signed-localhost-certificate https://stackoverflow.com/questions/7580508/getting-chrome-t...
- jakobegger 9y agoGet a certificate for a domain you control, then edit your /etc/hosts file to make that domain point to localhost – voila, valid cert for a server running locally.
- gorkonsine 9y agoThis site violates Betteridge's Law.
- gorkonsine 9y agoThis site doesn't address the countless small sites on $3/month shared-hosting plans. These generally do not provide shell access, so there's no way to use Let's Encrypt, therefor switching to https is not free, which means their assertion for point #4 is flat-out wrong. Web-hosting plans with shell access generally cost more money.
- otterpro 9y agoI recommend moving those cheap shared-hosting to VPS server, which don't cost more these days. For example, Vultr is only $2.50/month. Others like Ramnode.com can also be had for less than $3/month. For about the same price, you'd get better security, greater flexibility, and often better performance.
- reality_hacker 9y agoAnd much higher maintenance cost and learning curve.
- smacktoward 9y agoThere's nothing stopping the shared-hosting providers from handling the Let's Encrypt process for their clients themselves, and then either just using the resulting certs for client sites automatically or exposing an interface for generating and applying a cert through their Web control panel. They don't do that currently because customers aren't asking for it. If customers start asking, some will start. And once a few shared-hosting providers start providing HTTPS hosting, market pressure from educated customers can push the others into following suit.
- gorkonsine 9y ago>They don't do that currently because customers aren't asking for it. No, they don't do it because they offer their own "partner" services for $$.
- gnur 9y agoYou can still use LE without shell access, you can manually upload the verification files and have your domain validated that way. You can even use DNS to verify the ownership of a domain.