5 ms·

Switching an existing site to https properly is a fair amount of work from my experience helping migrate a major hotels chain site. you also really need to use

Switching an existing site to https properly is a fair amount of work from my experience helping migrate a major hotels chain site. you also really need to use spdy and have a plan to move to http 2

falcolas 12y ago
With the combination of nginx and various load balancers supporting ssl termination, I've yet to find this a major problem. The trick is to be willing to refactor how the infrastructure routes.
- sigzero 12y ago
  He didn't say it was a "problem". He said it was a "fair amount of work". Time is money and sometimes there is no money to do it.
  - mauricemir 12y ago
    And in our case the initial attempt was dropped on us with less than 2 week notice - it was also a radical restructuring of the site at the same time.
Someone1234 12y ago
It really doesn't have to be a fair amount of work. Just leave your existing HTTP property exactly as it is. Add a load balancer in front. Have the load balancer receive HTTPS and then send the traffic through to the property as HTTP, and finally restrict all other external access to the HTTP sites (i.e. load balancer only). You can buy off-the-shelf appliances which will do this for you. Except for maybe a firewall change, no changes would have to be made to existing code or servers.
- snowwrestler 12y ago
  You also need to scrub the existing site for content embedded with HTTP links, because active mixed content is blocked by default in Firefox and Chrome (as it should be). We did our first site HTTPS-only the exact way you describe, but didn't anticipate half our embedded content disappearing. The situation is getting better fast, but even a year ago a number of pretty well-known services like Scribd and Storify didn't fully work over HTTPS. Video is the worst; every TV network has its own embeddable video player, and most of them did not work at all over HTTPS until very recently. Again, that's getting better pretty fast.
  - snowwrestler 12y ago
    I came back to reply to myself that there is now a Content Security Policy header to deal with this exact situation: https://w3c.github.io/webappsec/specs/upgrade/ https://w3c.github.io/webappsec/specs/upgrade/ It is included in the Chrome 43 beta [1], and Firefox is working on it as well [2]. This is excellent news for folks looking to upgrade existing sites to HTTPS. [1] http://blog.chromium.org/2015/04/chrome-43-beta-web-midi-and-upgrading.html http://blog.chromium.org/2015/04/chrome-43-beta-web-midi-and... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1139297 https://bugzilla.mozilla.org/show_bug.cgi?id=1139297
- mauricemir 12y ago
  All this adds another layer and increases latency and slows the site down.

Switching an existing site to https properly is a fair amount of work from my experience helping migrate a major hotels chain site. you also really need to use spdy and have a plan to move to http 2

falcolas 12y ago

With the combination of nginx and various load balancers supporting ssl termination, I've yet to find this a major problem. The trick is to be willing to refactor how the infrastructure routes.

sigzero 12y ago
He didn't say it was a "problem". He said it was a "fair amount of work". Time is money and sometimes there is no money to do it.
- mauricemir 12y ago
  And in our case the initial attempt was dropped on us with less than 2 week notice - it was also a radical restructuring of the site at the same time.

Someone1234 12y ago

It really doesn't have to be a fair amount of work. Just leave your existing HTTP property exactly as it is. Add a load balancer in front. Have the load balancer receive HTTPS and then send the traffic through to the property as HTTP, and finally restrict all other external access to the HTTP sites (i.e. load balancer only). You can buy off-the-shelf appliances which will do this for you. Except for maybe a firewall change, no changes would have to be made to existing code or servers.

snowwrestler 12y ago
You also need to scrub the existing site for content embedded with HTTP links, because active mixed content is blocked by default in Firefox and Chrome (as it should be). We did our first site HTTPS-only the exact way you describe, but didn't anticipate half our embedded content disappearing. The situation is getting better fast, but even a year ago a number of pretty well-known services like Scribd and Storify didn't fully work over HTTPS. Video is the worst; every TV network has its own embeddable video player, and most of them did not work at all over HTTPS until very recently. Again, that's getting better pretty fast.
- snowwrestler 12y ago
  I came back to reply to myself that there is now a Content Security Policy header to deal with this exact situation: https://w3c.github.io/webappsec/specs/upgrade/ https://w3c.github.io/webappsec/specs/upgrade/ It is included in the Chrome 43 beta [1], and Firefox is working on it as well [2]. This is excellent news for folks looking to upgrade existing sites to HTTPS. [1] http://blog.chromium.org/2015/04/chrome-43-beta-web-midi-and-upgrading.html http://blog.chromium.org/2015/04/chrome-43-beta-web-midi-and... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1139297 https://bugzilla.mozilla.org/show_bug.cgi?id=1139297
mauricemir 12y ago
All this adds another layer and increases latency and slows the site down.