4 ms·

The 'web' is kind of for the commons, but HTTPS is just a few steps away from being 'easy'. The steps required are frankly just a little too weird and ugly. Mo

The 'web' is kind of for the commons, but HTTPS is just a few steps away from being 'easy'. The steps required are frankly just a little too weird and ugly. Most people making web sites, even many devs, don't necessarily want to, or have the wherewithal to deal with SSL. Setting up SSL on AWS recently was a monster pain the rear for our little nothing project site, granted a lot of that was AWS oriented. It needs to be easier, if it were easy, everyone would be doing it.

lucideer 8y ago
> many devs, don't [...] have the wherewithal to deal with SSL. I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared web host (though in that case the web host should be setting up certs automatically for them), but what exactly is complicated about setting up certs for a dev? https://certbot.eff.org/ https://certbot.eff.org/ holds your hand through the entire ~30 second process. It's simpler than most other tasks a dev needs to do while setting up a website.
- pbhjpbhj 8y ago
  I use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think. It is difficult if you want to understand the process, though no more so than, say, using Git IMO. In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install
  - jfk13 8y ago
    > It is difficult if you want to understand the process, though no more so than, say, using Git IMO. Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)
    - lucideer 8y ago
      I agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case
- foepys 8y ago
  Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place. The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.
  - lucideer 8y ago
    This is a very good point, but as you say and the article states, the lack of warnings for this is changing. There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).
- sethammons 8y ago
  certbot has failed continually on my DO instance. It cannot update my cert on cron. I have to manually update my cert when I remember to do so. In fact, I had forgotten to do this for the last several months, so my site gets to display a nice scary warning for anyone who might venture forth and try https. I've searched how to fix it and nothing comes up. The site is static html and I've considered just removing https.
  - jhomedall 8y ago
    What are the contents of your crontab? Anything in the certbot logs? What server software are you running?
- swebs 8y ago
  >but what exactly is complicated about setting up certs for a dev? Seeing as how he mentioned AWS, it's a bit more complicated if you have a cluster of servers that are automatically managed. You have to set up a reverse proxy and integrate that into your cloud provider's workflow.
- contras1970 8y ago
  > what exactly is complicated about setting up certs for a dev? it may not be complicated but you cannot beat doing nothing.
kalleboo 8y ago
With certbot, it really is trivial for anything that's not using some very unusual setup. Shared hosting systems like CPanel have also added support. Our biggest problem with the transition was mixed content issues with hardcoded HTTP URLs hidden away on long-forgotten pages.
zokier 8y ago
On AWS can't you just use ACM which is supposed to be pretty painless https://aws.amazon.com/blogs/aws/new-aws-certificate-manager-deploy-ssltls-based-apps-on-aws/ https://aws.amazon.com/blogs/aws/new-aws-certificate-manager... Doesn't seem that bad
- sonnyblarney 8y ago
  ACM combined with the various other services you need, especially Route53 or whatever, plus their byzantine new networking and security rules ... means you need to read a few sections of several different manuals to just do basic things. AWS has become very complex over the last few years - there was a period where you didn't need admins. Now it seems you do again, just cloud admins, not local machine admins.
  - zokier 8y ago
    But all the rest is just the normal stuff; I mean TLS isn't adding any further complexity there.
Sir_Cmpwn 8y ago
> many devs, don't [...] have the wherewithal to deal with SSL. Those devs need to be shamed and taught a lesson. >many train operators don't [...] have the wherewithal to read the safety manual >many police officers don't [...] have the wherewithal to attend gun safety classes >many senators don't [...] have the wherewithal to listen to their constituents

lucideer 8y ago

> many devs, don't [...] have the wherewithal to deal with SSL. I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared web host (though in that case the web host should be setting up certs automatically for them), but what exactly is complicated about setting up certs for a dev? https://certbot.eff.org/ https://certbot.eff.org/ holds your hand through the entire ~30 second process. It's simpler than most other tasks a dev needs to do while setting up a website.

pbhjpbhj 8y ago
I use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think. It is difficult if you want to understand the process, though no more so than, say, using Git IMO. In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install
- jfk13 8y ago
  > It is difficult if you want to understand the process, though no more so than, say, using Git IMO. Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)
  - lucideer 8y ago
    I agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case
foepys 8y ago
Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place. The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.
- lucideer 8y ago
  This is a very good point, but as you say and the article states, the lack of warnings for this is changing. There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).
sethammons 8y ago
certbot has failed continually on my DO instance. It cannot update my cert on cron. I have to manually update my cert when I remember to do so. In fact, I had forgotten to do this for the last several months, so my site gets to display a nice scary warning for anyone who might venture forth and try https. I've searched how to fix it and nothing comes up. The site is static html and I've considered just removing https.
- jhomedall 8y ago
  What are the contents of your crontab? Anything in the certbot logs? What server software are you running?
swebs 8y ago
>but what exactly is complicated about setting up certs for a dev? Seeing as how he mentioned AWS, it's a bit more complicated if you have a cluster of servers that are automatically managed. You have to set up a reverse proxy and integrate that into your cloud provider's workflow.
contras1970 8y ago
> what exactly is complicated about setting up certs for a dev? it may not be complicated but you cannot beat doing nothing.

kalleboo 8y ago

With certbot, it really is trivial for anything that's not using some very unusual setup. Shared hosting systems like CPanel have also added support. Our biggest problem with the transition was mixed content issues with hardcoded HTTP URLs hidden away on long-forgotten pages.

zokier 8y ago

On AWS can't you just use ACM which is supposed to be pretty painless https://aws.amazon.com/blogs/aws/new-aws-certificate-manager-deploy-ssltls-based-apps-on-aws/ https://aws.amazon.com/blogs/aws/new-aws-certificate-manager... Doesn't seem that bad

sonnyblarney 8y ago
ACM combined with the various other services you need, especially Route53 or whatever, plus their byzantine new networking and security rules ... means you need to read a few sections of several different manuals to just do basic things. AWS has become very complex over the last few years - there was a period where you didn't need admins. Now it seems you do again, just cloud admins, not local machine admins.
- zokier 8y ago
  But all the rest is just the normal stuff; I mean TLS isn't adding any further complexity there.

Sir_Cmpwn 8y ago

> many devs, don't [...] have the wherewithal to deal with SSL. Those devs need to be shamed and taught a lesson. >many train operators don't [...] have the wherewithal to read the safety manual >many police officers don't [...] have the wherewithal to attend gun safety classes >many senators don't [...] have the wherewithal to listen to their constituents