SSL now enabled

[crrodriguez]

Hi:

 

Sysadmin here We have enabled SSL in the website, and it is mandatory for the forum but optional in the main site.

 

This is intented to make the experience more secure, specially for forum user's passwords.

 

Use this post to report any problem you have with SSL access.

 

Cheers

[Tomorrow]

Looking good.No problems here with SSL access.In fact had you not mentioned it i would have not noticed

[crrodriguez]

Note that if you click "main site" in the forum menu, you will get front website over SSL, This is expected but not really intented, as a side effect of

the rolling of http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ;-)

 

The trick is done by your browser, once you enter the forum, a header is set telling you client "use ssl only for this domain", shouldnt harm, so I 'll leave it as is. :-D

[Tomorrow]

I fixed my bookmark for the forum too.Now it correctly links to this forum.Before it had the cannaverbe in the domain name.Now it's just https://ketarin.org/forum/

 

Main site appears over SSL for me too at any time no matter if i open it directly or trough the forum.

Only the Wiki is not in SSL yet: http://wiki.ketarin.org/index.php/Ketarin_Wiki

Edited July 1, 2011 by Tomorrow

[crrodriguez]

 

Main site appears over SSL for me too at any time no matter if i open it directly or trough the forum.

 

 

That is expected, proper browsers "remember" that the domain "ketarin.org" (not subdomains) is to be accessed over SSL,but only if you have visited a part of the site that demands SSL (like the forum) currently for 6 months (unless you delete your browser cache)

 

This is because your browser may send cookies over plain HTTP and break all application-side safe-guards.. :-) however cookies of this forum are currently being marked as "secure" hence no well behaving browser will send them in a plain text connection.

 

Only the Wiki is not in SSL yet: http://wiki.ketarin.org/index.php/Ketarin_Wiki

 

Only the main domain is available over SSL for now, the wiki is not, but may be in the future.

[Tomorrow]

Ok.Thank you for explaining

[crrodriguez]

Finally No Internet Explorer version supports HTTP Strict Transport Security, only Chrome and Firefox, so IE users wont benefit from it, the relevant HTTP header is ignored and does nothing :-(

 

I hope someday MS fixes their stuff to behave sanely, experience tells me it is not going to happend :-P

[shawn]

HSTS is still a draft. Not that it's not an important step forward, it's just not a standard. All the same, you can force SSL with any client using:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

[crrodriguez]

HSTS is still a draft. Not that it's not an important step forward, it's just not a standard. All the same, you can force SSL with any client using:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

 

That's exactly the way it is implemented already