5 ms·

The only reason why some sites still use http is because of the need to purchase an ssl certificate from one of the cartelized CA providers.

TazeTSchnitzel 12y ago
It's not just that. TLS setup is additional effort.
- IgorPartola 12y ago
  Let me walk you through it: $ openssl genrsa -out $server.key 2048 $ openssl req -new -sha256 -key $server.key -out $server.csr Get the CSR to a CA and get the cert in your email inbox. Compose the cert into a chain (the most painful part of the process). Put the cert and the key in /etc/ssl/certs/example.com.crt and respectively /etc/ssl/private/example.com.key; In your nginx config add the following: server { listen 443 ssl spdy; server_name www.example.com ssl on; ssl_session_timeout 5m; ssl_session_cache shared:SSL:5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; ssl_prefer_server_ciphers on; # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) add_header Strict-Transport-Security max-age=15768000; resolver 8.8.8.8; ssl_certificate /etc/ssl/certs/example.com.crt; ssl_certificate_key /etc/ssl/private/example.com.key; #... } Restart nginx. If you want to only do HTTPS, and have HTTP redirect to HTTPS: server { listen 80 default_server; server_name _; rewrite ^ https://www.example.com$request_uri permanent; } It took 3 minutes to write this comment. Getting a new cert up and running will take you $5 and 15 minutes if you follow these instructions. Free if you use startssl.com. Cheapest wildcard I found was https://www.ssls.com/ https://www.ssls.com/ when they ran a sale: $42. Current cheapest Google turned up was https://cheapsslsecurity.com/sslproducts/wildcardssl.html https://cheapsslsecurity.com/sslproducts/wildcardssl.html for $60. Personally, I prefer wildcard certs whenever possible, free certs from startssl.com.
  - TazeTSchnitzel 12y ago
    Sure, it's easy if you know the steps. But it's still additional effort. All web servers just do HTTP by default.
    - IgorPartola 12y ago
      Setting up passwords is additional effort. Just leave them blank. To me that doesn't seem like an excuse to subject your users to what HTTP entails, and to subject yourself to the liability it implies.
      - TazeTSchnitzel 12y ago
        It's not an excuse, but it is the reason why. That, and shared hosts.
  - kennycox 12y ago
    Why should we pay more? Same product available at cheaper price $60 for 1 year as well alphassl wildcard at $42. https://www.ssl2buy.com/cheap-wildcard-ssl-certificates-ads https://www.ssl2buy.com/cheap-wildcard-ssl-certificates-ads
sethhochberg 12y ago
How about ad fill rates? I'm not directly involved in add ops myself, but I've heard that now, even in 2015, major web properties still see a roughly 60% drop in ad revenue on HTTPS. Thats a big deal for an advertising supported website. (Though obviously not so much a big deal for a website like this selling an Ubuntu cell phone).
- r1ch 12y ago
  Yeah, it's the primary reason why I can't get any of our properties on https. Any ad supported platform / website simply can't afford to use https.
- deleted 12y ago
  [deleted]
mobiplayer 12y ago
True, and how stupid is that? We consider a self signed certificate to be worse than no encryption.
- mcdoug 12y ago
  It's because they are. How many times will this be brought up? The browser has no way of knowing whether gmail.com should be serving a self-signed cert (pinning notwithstanding), so it must treat a self-signed cert as a MITM attack at all times. Try to think through how else it could possibly work, and you'll see why the browsers do this.
  - mobiplayer 12y ago
    No, they are not. The browser should treat any HTTP connection as a MITM attack at all times, too. Actually, it should also treat it as multiple MITM because everyone in your network or in the path can see your traffic. We could argue if it even makes sense to differentiate between SSL with self-signed certs and plain HTTP connections when warning users, I'll give you that. But in no way SSL with self-signed are worse than HTTP. > Try to think through how else it could possibly work, and you'll see why the browsers do this. Funny :)

TazeTSchnitzel 12y ago

It's not just that. TLS setup is additional effort.

IgorPartola 12y ago
Let me walk you through it: $ openssl genrsa -out $server.key 2048 $ openssl req -new -sha256 -key $server.key -out $server.csr Get the CSR to a CA and get the cert in your email inbox. Compose the cert into a chain (the most painful part of the process). Put the cert and the key in /etc/ssl/certs/example.com.crt and respectively /etc/ssl/private/example.com.key; In your nginx config add the following: server { listen 443 ssl spdy; server_name www.example.com ssl on; ssl_session_timeout 5m; ssl_session_cache shared:SSL:5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; ssl_prefer_server_ciphers on; # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) add_header Strict-Transport-Security max-age=15768000; resolver 8.8.8.8; ssl_certificate /etc/ssl/certs/example.com.crt; ssl_certificate_key /etc/ssl/private/example.com.key; #... } Restart nginx. If you want to only do HTTPS, and have HTTP redirect to HTTPS: server { listen 80 default_server; server_name _; rewrite ^ https://www.example.com$request_uri permanent; } It took 3 minutes to write this comment. Getting a new cert up and running will take you $5 and 15 minutes if you follow these instructions. Free if you use startssl.com. Cheapest wildcard I found was https://www.ssls.com/ https://www.ssls.com/ when they ran a sale: $42. Current cheapest Google turned up was https://cheapsslsecurity.com/sslproducts/wildcardssl.html https://cheapsslsecurity.com/sslproducts/wildcardssl.html for $60. Personally, I prefer wildcard certs whenever possible, free certs from startssl.com.
- TazeTSchnitzel 12y ago
  Sure, it's easy if you know the steps. But it's still additional effort. All web servers just do HTTP by default.
  - IgorPartola 12y ago
    Setting up passwords is additional effort. Just leave them blank. To me that doesn't seem like an excuse to subject your users to what HTTP entails, and to subject yourself to the liability it implies.
    - TazeTSchnitzel 12y ago
      It's not an excuse, but it is the reason why. That, and shared hosts.
- kennycox 12y ago
  Why should we pay more? Same product available at cheaper price $60 for 1 year as well alphassl wildcard at $42. https://www.ssl2buy.com/cheap-wildcard-ssl-certificates-ads https://www.ssl2buy.com/cheap-wildcard-ssl-certificates-ads

sethhochberg 12y ago

How about ad fill rates? I'm not directly involved in add ops myself, but I've heard that now, even in 2015, major web properties still see a roughly 60% drop in ad revenue on HTTPS. Thats a big deal for an advertising supported website. (Though obviously not so much a big deal for a website like this selling an Ubuntu cell phone).

r1ch 12y ago
Yeah, it's the primary reason why I can't get any of our properties on https. Any ad supported platform / website simply can't afford to use https.
deleted 12y ago
[deleted]

mobiplayer 12y ago

True, and how stupid is that? We consider a self signed certificate to be worse than no encryption.

mcdoug 12y ago
It's because they are. How many times will this be brought up? The browser has no way of knowing whether gmail.com should be serving a self-signed cert (pinning notwithstanding), so it must treat a self-signed cert as a MITM attack at all times. Try to think through how else it could possibly work, and you'll see why the browsers do this.
- mobiplayer 12y ago
  No, they are not. The browser should treat any HTTP connection as a MITM attack at all times, too. Actually, it should also treat it as multiple MITM because everyone in your network or in the path can see your traffic. We could argue if it even makes sense to differentiate between SSL with self-signed certs and plain HTTP connections when warning users, I'll give you that. But in no way SSL with self-signed are worse than HTTP. > Try to think through how else it could possibly work, and you'll see why the browsers do this. Funny :)