3 ms·

> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-c

> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. This is not so great for radio streaming as a lot of them still use http shoutcast servers (often with direct ip instead of domain name, so no https there anyway).

mdaniel 2y ago
> (often with direct ip instead of domain name, so no https there anyway). That's not true, one can have IP addresses in certificates, it's just very rare because virtual hosting makes "single IP" services rare nowadays: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 ("Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).") OpenSSL uses "IP:" syntax in their subjectAltName field (e.g. https://mta.openssl.org/pipermail/openssl-users/2016-September/004515.html https://mta.openssl.org/pipermail/openssl-users/2016-Septemb... ) and the CAB seems to be on-board, subject to some "well, watch out for ..." language https://cabforum.org/working-groups/server/guidance-ip-addresses-certificates/ https://cabforum.org/working-groups/server/guidance-ip-addre...
- _flux 2y ago
  So do CAs in general offer those? Are they as affordable as "normal" certs? Certainly you need to be paying for that those kind of certificates, possibly some premium? It's probably not worth it anyway, because you're now stuck with that single IP, for little benefit. In general IPs just don't get HTTPS certificates acquired for them.
  - mdaniel 2y ago
    Seems to be free from ZeroSSL https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I... but Letsencrypt decided against it since their whole thing is about proving ownership over a domain, or set of domains, and doing that for an IP address would be some nonsense. I would be absolutely shocked if the "name brand" cert issuers don't support CSRs containing iPAddress SAN entries, since it's very clearly part of the RFC, but I haven't ever had a need to try such a stunt, either
  - wslwsl 2y ago
    you can get a free cert from ZeroSSL for an IP address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I...
- deleted 2y ago
  [deleted]
ayewo 2y ago
> (often with direct ip instead of domain name, so no https there anyway). Real-world counter example of an IP address available over https: https://1.1.1.1 https://1.1.1.1
conradfr 2y ago
I guess I stand corrected on the ip / https thing :)

mdaniel 2y ago

> (often with direct ip instead of domain name, so no https there anyway). That's not true, one can have IP addresses in certificates, it's just very rare because virtual hosting makes "single IP" services rare nowadays: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 ("Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).") OpenSSL uses "IP:" syntax in their subjectAltName field (e.g. https://mta.openssl.org/pipermail/openssl-users/2016-September/004515.html https://mta.openssl.org/pipermail/openssl-users/2016-Septemb... ) and the CAB seems to be on-board, subject to some "well, watch out for ..." language https://cabforum.org/working-groups/server/guidance-ip-addresses-certificates/ https://cabforum.org/working-groups/server/guidance-ip-addre...

_flux 2y ago
So do CAs in general offer those? Are they as affordable as "normal" certs? Certainly you need to be paying for that those kind of certificates, possibly some premium? It's probably not worth it anyway, because you're now stuck with that single IP, for little benefit. In general IPs just don't get HTTPS certificates acquired for them.
- mdaniel 2y ago
  Seems to be free from ZeroSSL https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I... but Letsencrypt decided against it since their whole thing is about proving ownership over a domain, or set of domains, and doing that for an IP address would be some nonsense. I would be absolutely shocked if the "name brand" cert issuers don't support CSRs containing iPAddress SAN entries, since it's very clearly part of the RFC, but I haven't ever had a need to try such a stunt, either
- wslwsl 2y ago
  you can get a free cert from ZeroSSL for an IP address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I...
deleted 2y ago
[deleted]

ayewo 2y ago

> (often with direct ip instead of domain name, so no https there anyway). Real-world counter example of an IP address available over https: https://1.1.1.1 https://1.1.1.1

conradfr 2y ago

I guess I stand corrected on the ip / https thing :)