SSL for PE

**strawberrybrick** · 05-17-2017

Hey guys, may I suggest that you use https for the PE site? You can get a free certificate from Let's Encrypt (which is backed by just about every major web org), that's very easy to install and setup. I can help if you need it.

https://letsencrypt.org/

**strawberrybrick** · 05-25-2017

Nothing, guys?

**Duncan Glenday** · 06-19-2017

Sorry - not (deliberately

) ignoring you - I'll get onto this shortly.

Bear in mind that an SSL would have had NO impact on the hack we had a few weeks ago.

**strawberrybrick** · 02-13-2018

But since we're typing a lot here, SSL would be good.. and free: https://letsencrypt.org/

**battema** · 04-26-2018

Got forced to change my password by vBulletin this morning. I had been waiting to "upgrade" to a stronger password once I knew for certain PE was secure.

How are things looking on that front?

**markwoll** · 04-26-2018

Originally Posted by battema

Got forced to change my password by vBulletin this morning. I had been waiting to "upgrade" to a stronger password once I knew for certain PE was secure.

How are things looking on that front?

I suspect crickets chirping

**battema** · 04-26-2018

Yep, never hurts to ask tho

**Jerjo** · 04-26-2018

It's not like PE is Duncan's day job. It can wait.

**Sean** · 04-26-2018

Duncan is overseas for the next few weeks.

**battema** · 04-26-2018

Yep, no instant worries

Just thought I'd ask since the reset reminded me.

**strawberrybrick** · 04-27-2018

Originally Posted by Jerjo

It's not like PE is Duncan's day job. It can wait.

As much as I appreciate the work involved (running my own sites), however Let's Encrypt is not only free, but takes minutes to set up. It's so easy, and protects all of us.

**strawberrybrick** · 07-17-2018

*bump*

just fyi, but google chrome goes SSL by default on 7/24; PE doesn't load properly over SSL.

**stevea** · 08-17-2018

Originally Posted by strawberrybrick

*bump*

just fyi, but google chrome goes SSL by default on 7/24; PE doesn't load properly over SSL.

The problem here is not all the elements are secure and the non-secure elements are being dropped by the browser.

I recently converted progforums.com to SSL and used PHP code in the forum header to re-write the address bar to the https version of any page. This can also be achieved in the .htaccess file on Apache systems.

One problem is, if one of your users links, for example, an image on a remote site that is not secure, the browser will report that the page security is broken and the image won't appear (or in IE, it'll ask you if you want to display the non-secure items). I was able to use the forum's censoring rules to convert some known addresses to https - for example I have a rule that converts http://www.progforums.com to https://www.progforums.com. This saved me having to find them all and correct them manually!

Of course, you can't simply convert all http:// to https:// because you can't guarantee any particular remote site is secure.

It is a bit of a can of worms, unfortunately

**strawberrybrick** · 08-21-2018

On my sites, urls are written //www.whatever.com/ and the code appends the rest. I know it's worms, but there's no other way forward.

**stevea** · 08-21-2018

Well with forum software, its usually a case of changing a base URL somewhere in the database, but then you need to make sure anyone hitting the site from the old URL gets redirected to the secure version. This also helps search engines find your site and stops them thinking your site is duplicated.

As I said, I did this in the php file that generates the header of each page and I assume a similar thing could be done to a vBulletin site.

If I was going to do it here, my code would be something like this:

Code:

$redirect = false;

$path = $_SERVER['REQUEST_URI'];





$url = $_SERVER['HTTP_HOST'];

if ($url != 'www.progressiveears.org') {

    $redirect = true;

}

$SSL_test = $_SERVER['HTTPS'];
if ($SSL_test != true) {
  $redirect = true;

}



if ($redirect==true){

    header('HTTP/1.1 301 Moved Permanently');

    header('Location: https://www.progressiveears.org'  .$path);

}

This will ensure any incoming URL that doesn't match www.progressiveears.org or is not https gets rewritten.