5 ms·

SSL now available for Tumblr blogs with custom domains

62 points by sprybear 9y ago

davidpelayo 9y ago
How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?
- rsynnott 9y ago
  Does Tumblr actually allow the embedding of arbitrary images? I've never knowingly seen a Tumblr blog embed external ones; they always seem to be Tumblr-hosted.
  - ameliaquining 9y ago
    Yes, Tumblr themes can contain arbitrary HTML. Letting Tumblr host theme assets is generally the easiest way to make them available though.
- captn3m0 9y ago
  Most browsers will give a mixed-content warning, but still serve images. Edit: found a reference[0] on the tumblr help site: >Keep in mind that enabling the option for a theme that wasn’t developed to support SSL may cause “mixed content” errors. If your blog looks weird after you turn SSL on, some resources that the theme needs to render itself may not be getting loaded. >If you're a theme developer and you'd like to ensure your themes support SSL, make sure that any externally hosted resources such as Cascading Style Sheets (CSS) or Javascript files are served either using HTTPS or a protocol-relative URL. If these files aren’t available over HTTPS, consider uploading them at the Theme Customization page (In your blog settings, click “Edit HTML” and then “Theme assets”). [0]: https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encryption https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encry...
sideproject 9y ago
How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it (https://codeascraft.com/2017/01/31/how-etsy-manages-https-and-ssl-certificates-for-custom-domains-on-pattern/ https://codeascraft.com/2017/01/31/how-etsy-manages-https-an...) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.
- j_s 9y ago
  I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid. https://caddyserver.com/ https://caddyserver.com/ I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempting to convert the resulting certificate format into something I could take back to IIS. Those securing custom subdomains are looking forward to January 2018 when wildcard certificates arrive. https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...
  - ngrilly 9y ago
    By design, Caddy doesn't support SAN certificates: https://github.com/mholt/caddy/issues/831 https://github.com/mholt/caddy/issues/831
    - j_s 9y ago
      Thanks for clearing up my confusion. From the discussion there it looks like this project might meet OP's needs: https://github.com/containous/traefik https://github.com/containous/traefik
      - ngrilly 9y ago
        Yes, it looks like Traefik handles SAN certificates from LE.
Kelab 9y ago
tumblr no longer allow custom domain i just check
- detaro 9y ago
  What did you check? They still document it, I can't find an announcement otherwise and on my account I still have the option to enable it.
- atomicnumber1 9y ago
  I've https for custom domain for like a month now. Please check again.

62 points by sprybear 9y ago

How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?

rsynnott 9y ago
Does Tumblr actually allow the embedding of arbitrary images? I've never knowingly seen a Tumblr blog embed external ones; they always seem to be Tumblr-hosted.
- ameliaquining 9y ago
  Yes, Tumblr themes can contain arbitrary HTML. Letting Tumblr host theme assets is generally the easiest way to make them available though.
captn3m0 9y ago
Most browsers will give a mixed-content warning, but still serve images. Edit: found a reference[0] on the tumblr help site: >Keep in mind that enabling the option for a theme that wasn’t developed to support SSL may cause “mixed content” errors. If your blog looks weird after you turn SSL on, some resources that the theme needs to render itself may not be getting loaded. >If you're a theme developer and you'd like to ensure your themes support SSL, make sure that any externally hosted resources such as Cascading Style Sheets (CSS) or Javascript files are served either using HTTPS or a protocol-relative URL. If these files aren’t available over HTTPS, consider uploading them at the Theme Customization page (In your blog settings, click “Edit HTML” and then “Theme assets”). [0]: https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encryption https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encry...

sideproject 9y ago

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it (https://codeascraft.com/2017/01/31/how-etsy-manages-https-and-ssl-certificates-for-custom-domains-on-pattern/ https://codeascraft.com/2017/01/31/how-etsy-manages-https-an...) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

j_s 9y ago
I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid. https://caddyserver.com/ https://caddyserver.com/ I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempting to convert the resulting certificate format into something I could take back to IIS. Those securing custom subdomains are looking forward to January 2018 when wildcard certificates arrive. https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...
- ngrilly 9y ago
  By design, Caddy doesn't support SAN certificates: https://github.com/mholt/caddy/issues/831 https://github.com/mholt/caddy/issues/831
  - j_s 9y ago
    Thanks for clearing up my confusion. From the discussion there it looks like this project might meet OP's needs: https://github.com/containous/traefik https://github.com/containous/traefik
    - ngrilly 9y ago
      Yes, it looks like Traefik handles SAN certificates from LE.

Kelab 9y ago

tumblr no longer allow custom domain i just check

detaro 9y ago
What did you check? They still document it, I can't find an announcement otherwise and on my account I still have the option to enable it.
atomicnumber1 9y ago
I've https for custom domain for like a month now. Please check again.