7 ms·

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what sho

by runn1ng 14y ago

OK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?

superprime 14y ago
You can use mod_ssl: http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring-ssl-under-apache.html http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring... . Other good resources are an easy search away. There are basically two steps, both of which can be at no additional cost: 1. get a certificate, and 2. configure your server to use the certificate. You can generate a certificate yourself, without paying anyone, and it will work fine, but some browsers will throw up a warning page if it is not signed by an authority (more: http://www.namecheap.com/support/knowledgebase/article.aspx/334 http://www.namecheap.com/support/knowledgebase/article.aspx/...).
- julian37 14y ago
  tptacek explained to me once how using a self-signed certificate (or more to the point, trusting it) is a bad idea: http://news.ycombinator.com/item?id=2376644 http://news.ycombinator.com/item?id=2376644 You can get free certificates backed by a CA trusted by most browsers, for example at https://www.startssl.com https://www.startssl.com. There are some limitations (e.g. no wildcard certificates) but it's still much better than a self-signed one.
  - mgummelt 14y ago
    Though using self-signed certs during development is a perfect way to test https without shelling out for a CA signature.
shanemhansen 14y ago
Unfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site. As for making it https, (hypothetical web developer) most cheap hosting providers actually provide tools for managing certs and apache configs in cpanel. It's not too difficult to do yourself. Basically install mod_ssl and copy paste a standard config, substituting the pathnames for the paths of the certs you got from a CA. I understand that your average beginning-throw-up-a-website-for-a-business would find this difficult, but they can hire someone for an hour to install their certificates.
- kanzure 14y ago
  > Unfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site. Wtf guys? Didn't we /just/ do this about GoDaddy? Just say NoDaddy. free certs: https://cert.startcom.org/ https://cert.startcom.org/ or https://www.startssl.com/ https://www.startssl.com/
nostromo 14y ago
A simple way to side-step the issue entirely is to use an OAuth provider you trust. If you'll allow me to shamelessly self-promote. We make it really easy to do this correctly using an email and password at my startup: https://www.dailycred.com/ https://www.dailycred.com/
- geofft 14y ago
  That can't possibly work, right? If a user accesses my website over unsecured HTTP, gets sent to an HTTPS DailyCred (or other OAuth provider) site to log in, and back to my unsecured HTTP site, they're still as vulnerable to man-in-the-middle attacks as if the OAuth provider didn't use HTTPS. In particular, a man-in-the-middle can capture the redirect to DailyCred and instead send the user to some trojaned site to capture their username and password (and then forward it on to you to get a legitimate token, but the password's been leaked in the process). I don't think it's helpful to say "we do HTTPS so you don't have to". Your users still need to be using HTTPS and preferably HSTS, unless I'm misunderstanding the intended use case. (I'm very happy to see that you guys do HSTS, though!)
  - nostromo 14y ago
    All of our inbound links and API calls from our clients are https from the get go. However, you are correct that a man-in-the-middle could rewrite the http website of someone using us to change the links to http from https and then perform a man-in-the-middle attack on that request. Because of this narrow risk, we encourage our clients to still get ssl certs as they grow. However, when they are small MVPish non-sensitive apps with 50 users, the risk of this kind of attack is very small. (For example, Facebook Connect, which has the same vulnerability I described, would be a much more obvious target with a very high payload.) The way we see it is getting people who are about to either store plaintext passwords or not salt their hashes correctly or pass them over non-https (like HN by default, boo!) or mess up a dozen other things, we're much more secure.
    - mattmanser 14y ago
      Don't ever tell people to use OAuth as an 'alternative' 1. It's a shitty UX 2. There are more people without an OAuth provider than there are with them 3. It's a sure fire way of killing your conversions 4. It means people start getting tethered to providers 5. It's very complicated when it goes wrong 6. THIS DOESN'T SOLVE THE OP'S QUESTION AT ALL. OP POINTS IT OUT. YOU IGNORE OP. Enabling SSL stops people sniffing sensitive data on public wifis. That's why everyone says enable SSL by default. Also there's something wrong if you're a programmer and can't afford an SSL cert as it's the same price as a couple of beers. I also find your password advice extremely questionable, it just doesn't make sense to me.
krzysz00 14y ago
If it's for your own development work, Debian/Ubuntu will generate a self-signed SSL certificate when you install the package `ssl-cert`.
tlrobinson 14y ago
If you don't want to worry about buying certificates and configuring webservers for HTTPS, check out CloudFlare. It's a bit expensive ($20/month for the first site, $5/month for additional sites) if all you care about is SSL, but they offer a lot more than just SSL: http://www.cloudflare.com/ http://www.cloudflare.com/ http://blog.cloudflare.com/easiest-ssl-ever-now-included-automatically-w http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...
bigiain 14y ago
OK, please educate me. (Take me as a model restauranteur.) I occasionally quickly cook meals in my kitchen. I never figured out what I should do exactly to set up the dishwasher with detergent, without needing to pay for the detergent. I just have a simple kitchen and I don't really understand dishwashing. How should I make it "hygienic"? (That guy would get shut down by the health authorities as soon as he started serving food to the public. Why aren't web developers offering their systems to the public held to basic data safety practices?)
- geofft 14y ago
  Because most people grow up knowing how to use dishwashers, but not knowing how to use SSL. Until we get to that point, we should focus on educating and informing people instead of snarking at them and hoping they get shut down.
  - shiven 14y ago
    The OP's (parody) comment is not about using dishwashers, but rather about dishwashing without using any detergent despite knowing that detergent is to dishwashing as SSL Certs is to https ... and FTR, I did not grow up knowing how to use dishwashers but was quite aware of the basic relationship between the act of dishwashing and detergents. Extrapolating that fundamental relationship to a dishwasher is to say the least -- elementary.
bigiain 14y ago
And, upon re-reading my other answer and noticing it came out far snarkier on screen than it did in my head… Sorry 'bout that… http://www.startssl.com/ http://www.startssl.com/ will give you a free SSL cert. They've got a "How to install" section that specifically deals with Apache (and another one which deals with WHM/cPanel if you're using that for your LAMP management). It's less than an afternoon's work to get up to speed. Note that you'll need a dedicated ip address (or you might settle for a server running new enough versions of Apache to use SNI - http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI - but that'll still not work for IE6 and very old versions of other browsers - pre 2.0 for Firefox)
- wiradikusuma 14y ago
  For the sake of completion: http://en.wikipedia.org/wiki/Server_Name_Indication#No_support http://en.wikipedia.org/wiki/Server_Name_Indication#No_suppo...
- runn1ng 14y ago
  This looks very good and easy to get it working. Will try next time, thanks!
PhantomLobe 14y ago
https://www.startssl.com/ https://www.startssl.com/ There you get free certificates, along with other instructions given, you're free to go.

by runn1ng 14y ago

superprime 14y ago

You can use mod_ssl: http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring-ssl-under-apache.html http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring... . Other good resources are an easy search away. There are basically two steps, both of which can be at no additional cost: 1. get a certificate, and 2. configure your server to use the certificate. You can generate a certificate yourself, without paying anyone, and it will work fine, but some browsers will throw up a warning page if it is not signed by an authority (more: http://www.namecheap.com/support/knowledgebase/article.aspx/334 http://www.namecheap.com/support/knowledgebase/article.aspx/...).

julian37 14y ago
tptacek explained to me once how using a self-signed certificate (or more to the point, trusting it) is a bad idea: http://news.ycombinator.com/item?id=2376644 http://news.ycombinator.com/item?id=2376644 You can get free certificates backed by a CA trusted by most browsers, for example at https://www.startssl.com https://www.startssl.com. There are some limitations (e.g. no wildcard certificates) but it's still much better than a self-signed one.
- mgummelt 14y ago
  Though using self-signed certs during development is a perfect way to test https without shelling out for a CA signature.

shanemhansen 14y ago

Unfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site. As for making it https, (hypothetical web developer) most cheap hosting providers actually provide tools for managing certs and apache configs in cpanel. It's not too difficult to do yourself. Basically install mod_ssl and copy paste a standard config, substituting the pathnames for the paths of the certs you got from a CA. I understand that your average beginning-throw-up-a-website-for-a-business would find this difficult, but they can hire someone for an hour to install their certificates.

kanzure 14y ago
> Unfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site. Wtf guys? Didn't we /just/ do this about GoDaddy? Just say NoDaddy. free certs: https://cert.startcom.org/ https://cert.startcom.org/ or https://www.startssl.com/ https://www.startssl.com/

nostromo 14y ago

A simple way to side-step the issue entirely is to use an OAuth provider you trust. If you'll allow me to shamelessly self-promote. We make it really easy to do this correctly using an email and password at my startup: https://www.dailycred.com/ https://www.dailycred.com/

geofft 14y ago
That can't possibly work, right? If a user accesses my website over unsecured HTTP, gets sent to an HTTPS DailyCred (or other OAuth provider) site to log in, and back to my unsecured HTTP site, they're still as vulnerable to man-in-the-middle attacks as if the OAuth provider didn't use HTTPS. In particular, a man-in-the-middle can capture the redirect to DailyCred and instead send the user to some trojaned site to capture their username and password (and then forward it on to you to get a legitimate token, but the password's been leaked in the process). I don't think it's helpful to say "we do HTTPS so you don't have to". Your users still need to be using HTTPS and preferably HSTS, unless I'm misunderstanding the intended use case. (I'm very happy to see that you guys do HSTS, though!)
- nostromo 14y ago
  All of our inbound links and API calls from our clients are https from the get go. However, you are correct that a man-in-the-middle could rewrite the http website of someone using us to change the links to http from https and then perform a man-in-the-middle attack on that request. Because of this narrow risk, we encourage our clients to still get ssl certs as they grow. However, when they are small MVPish non-sensitive apps with 50 users, the risk of this kind of attack is very small. (For example, Facebook Connect, which has the same vulnerability I described, would be a much more obvious target with a very high payload.) The way we see it is getting people who are about to either store plaintext passwords or not salt their hashes correctly or pass them over non-https (like HN by default, boo!) or mess up a dozen other things, we're much more secure.
  - mattmanser 14y ago
    Don't ever tell people to use OAuth as an 'alternative' 1. It's a shitty UX 2. There are more people without an OAuth provider than there are with them 3. It's a sure fire way of killing your conversions 4. It means people start getting tethered to providers 5. It's very complicated when it goes wrong 6. THIS DOESN'T SOLVE THE OP'S QUESTION AT ALL. OP POINTS IT OUT. YOU IGNORE OP. Enabling SSL stops people sniffing sensitive data on public wifis. That's why everyone says enable SSL by default. Also there's something wrong if you're a programmer and can't afford an SSL cert as it's the same price as a couple of beers. I also find your password advice extremely questionable, it just doesn't make sense to me.

krzysz00 14y ago

If it's for your own development work, Debian/Ubuntu will generate a self-signed SSL certificate when you install the package `ssl-cert`.

tlrobinson 14y ago

If you don't want to worry about buying certificates and configuring webservers for HTTPS, check out CloudFlare. It's a bit expensive ($20/month for the first site, $5/month for additional sites) if all you care about is SSL, but they offer a lot more than just SSL: http://www.cloudflare.com/ http://www.cloudflare.com/ http://blog.cloudflare.com/easiest-ssl-ever-now-included-automatically-w http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...

bigiain 14y ago

OK, please educate me. (Take me as a model restauranteur.) I occasionally quickly cook meals in my kitchen. I never figured out what I should do exactly to set up the dishwasher with detergent, without needing to pay for the detergent. I just have a simple kitchen and I don't really understand dishwashing. How should I make it "hygienic"? (That guy would get shut down by the health authorities as soon as he started serving food to the public. Why aren't web developers offering their systems to the public held to basic data safety practices?)

geofft 14y ago
Because most people grow up knowing how to use dishwashers, but not knowing how to use SSL. Until we get to that point, we should focus on educating and informing people instead of snarking at them and hoping they get shut down.
- shiven 14y ago
  The OP's (parody) comment is not about using dishwashers, but rather about dishwashing without using any detergent despite knowing that detergent is to dishwashing as SSL Certs is to https ... and FTR, I did not grow up knowing how to use dishwashers but was quite aware of the basic relationship between the act of dishwashing and detergents. Extrapolating that fundamental relationship to a dishwasher is to say the least -- elementary.

bigiain 14y ago

And, upon re-reading my other answer and noticing it came out far snarkier on screen than it did in my head… Sorry 'bout that… http://www.startssl.com/ http://www.startssl.com/ will give you a free SSL cert. They've got a "How to install" section that specifically deals with Apache (and another one which deals with WHM/cPanel if you're using that for your LAMP management). It's less than an afternoon's work to get up to speed. Note that you'll need a dedicated ip address (or you might settle for a server running new enough versions of Apache to use SNI - http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI - but that'll still not work for IE6 and very old versions of other browsers - pre 2.0 for Firefox)

wiradikusuma 14y ago
For the sake of completion: http://en.wikipedia.org/wiki/Server_Name_Indication#No_support http://en.wikipedia.org/wiki/Server_Name_Indication#No_suppo...
runn1ng 14y ago
This looks very good and easy to get it working. Will try next time, thanks!

PhantomLobe 14y ago

https://www.startssl.com/ https://www.startssl.com/ There you get free certificates, along with other instructions given, you're free to go.