SSL with Psynews

[mars]

Hello

In the past you could connect to psynews via SSL but it was via a self-signed certificate and even though it was valid, your browers complained. There were also issues on certain actons (viewing messages wouldn't work).

 

This week RTP and I paid for a 5-year legit SSL certificate issued by a known certificate authority and I tweaked a few details so that all actions work.

I also changed the board config so that you're automatically redirected to a secure login even if you access the login page via plain http

 

You may now browse securely in Psynews.org through https://www.psynews.org

[Insejn]

Good job guys!

[transistor91]

You can get a free one for non-commercial use from StartSSL.

[Richpa]

Thanks RTP and Mars!

[mars]

You can get a free one for non-commercial use from StartSSL.

http://en.wikipedia.org/wiki/StartCom#Limitations_of_StartSSL_Free

http://en.wikipedia.org/wiki/StartCom#Response_to_heartbleed

http://en.wikipedia.org/wiki/StartCom#Criticism

 

Interesting, but as usual I'm more concerned about having a reliable service than a free service, for, time is more vluable than anything else.

[mars]

As someone pointed out, even when surfing on the forum via https, some parts of the board were falling back to plain http (eg messaging).

We can switch IPB to https by default but then you have to always connect via https or you'll have issues with accessing messaging, and so on...which is not good when you're surfing from bookmarked pages (and don't really care about https anyway).

Our board, IPB is not the best when it comes to SSL. We'll see how it improves with the forthcoming v4.

 

In the meantime, I've forced the use of https throughout the board for everyone. If you request any (even bookmarked) page via http, it'll automatically redirect to the same page in https.

 

If you don't undertsand this post, nevermind, just enjoy surfing on psynews in a secure way

[Rotwang]

There's a new major version of IPB on the way?

 

[shudder]

[mars]

Yes, they're preparing v4, I have access to test boards, it's looking good. But as usual I'll wait till other forums have suffered from the shitty migration issues and bugs.

[RTP]

I hope it works for everybody meanwhile.

In case some of you still surf plain http (redirection didn't work seamless with IE at first), best would be to update bookmarks if you want to enjoy the new secure one...

 

I say a big thanks to Mars that he implemented this, I probably wouldn't have been able to the way he did because the part to configure the board that it doesn't fall back to http seemed quite tricky!