Forced https? ???

u/Adriweb July 25, 2015, 05:59:58 PM

Quote from: DJ Omnimaga on July 25, 2015, 05:55:34 PM
I don't exactly remember what it was, but it was about untrusted certificate and it asked me to accept it. I have the same problem on many other HTTPS website (eg TVA Nouvelles).

Hmm, so this phone (or at least that old OS on the phone) somehow doesn't know/trust StartSSL (the signing authority)...
I guess it's ok with a bit more recent OSes, with updated trust stores...

u/Dream of Omnimaga July 25, 2015, 06:01:04 PM

Yeah that could explain it. Thankfully, the site still works. I guess it might just be a bit annoying for certain users or scary for technology-illiterate users to have such warning.

u/novenary July 25, 2015, 07:37:19 PM

Ah yeah, StartSSL. They're not trusted by everyone, or at least not until recently.

u/Lionel Debroux July 25, 2015, 07:45:57 PM

Few browsers trusted CACert by default, but StartSSL has been well supported by the mainstream browsers for years.
It's heart-breaking for users that manufacturers are so careless about updating devices

u/Dream of Omnimaga July 25, 2015, 08:14:52 PM

What is strange is that back in the days, certain certificates seemed trusted by almost every browser, old or new. Even older versions of IE seemed to have no issue displaying such site, aside from a warning about how we are about to enter a secured connection, which we could disable. I am bettering that those certificates were the ones that costed several hundreds of dollars, though. I myself would never pay this much for a certificate unless I was really serious about a website. Not that I am not serious about CW, but it only averages at 4000 page views a day and doesn't even have a shop (it used to, but it was external).

EDIT: Also, the Facebook sharing doesn't work by default on HTTPS now. It says content was blocked. The FB button at the top of the page works, but not the one in the first post of each topic.

Last Edit: July 25, 2015, 09:14:24 PM by DJ Omnimaga

u/Unicorn July 26, 2015, 04:33:08 AM

So I read up on the web browser, and it has support for SSL, and a clouple of other things..

u/Lionel Debroux July 26, 2015, 06:50:16 AM

The Startcom Class 1 certificate is for no fee, and the Class 2 certificate, with wildcard support, was only $30 a year when we bought one for TI-Planet + Inspired-Lua, which is far better than the other CAs.
The Let's Encrypt initiative from Mozilla, the EFF and friends, which is supposed to produce its first certificate next week and become available for the general public in September, will change the cards in the CA business, at long last.

u/Dream of Omnimaga July 26, 2015, 04:31:05 PM

Hm interesting. Ideally we would prefer to use free certificates since Juju can't even afford to pay CW hosting right now (I pay most of it ATM).

u/Snektron July 26, 2015, 06:01:56 PM

Quote from: DJ Omnimaga on July 26, 2015, 04:31:05 PM
Hm interesting. Ideally we would prefer to use free certificates since Juju can't even afford to pay CW hosting right now (I pay most of it ATM).

I still had like one dollar on the paypal account i never use (Since i need to make a minimum transaction of €25 to put money on it

) so i figured, why not give it?
Also since CW has a lot of Dutch members maybe it's worth adding iDeal as payment method?

Last Edit: July 26, 2015, 06:03:59 PM by Cumred_Snektron

u/Dream of Omnimaga July 27, 2015, 12:54:31 AM

Is iDeals a Dutch-only thing? I could perhaps check if SMF has a plugin that adds support for it.

u/Yuki July 27, 2015, 03:40:50 AM

Yeah, I enabled HSTS the other day. As Streetwalrus said, you still have access to HTTP, and since HSTS is fairly new, your old browser should not do the redirection since it don't know yet how to do that. And even on new browsers, it only works if you already went on HTTPS at least once since I activated it and there's a way in the settings (at least on Chrome, you may probably have to delete some cache file) to "forget" you already visited that site on HTTPS.

For the certificates, we use the ones at Namecheap, they're often free with a new domain name, otherwise they're real cheap, like $1.88 if I remember well. And they do the job. There's errors on Omnimaga and CodeWalrus, but it's because we serve HTTP content over HTTPS, which is quite normal for a server, I guess, and this error should be ignorable.

u/Snektron July 28, 2015, 07:44:13 PM

Quote from: DJ Omnimaga on July 27, 2015, 12:54:31 AM
Is iDeals a Dutch-only thing? I could perhaps check if SMF has a plugin that adds support for it.

Yeah i think it is. It's supported on many international platforms though