I have been searching the internet for two days and I am stuck. I understand that I can purchase an SSL certificate to make my site work for HTTPS so that it is more secure and all that jazz.
My question is do I have to do anything special on the HTML/PHP pages I create for this site, like some PHP call to open a session, or does the fact that there is an SSL Cert on the server mean I don't have to change anything on the HTML pages?
Sorry if this is a dumb question, but I can't find the answer anywhere.
Its primary the setup of the server, e.g. that you have to make the site accessible by SSL (port etc) and configure the certificates.
But maybe you need to make adjustments to your HTML etc too, so that all resources (images, script, css..) will be loaded by SSL too, e.g. all these includes should be either be done with site-relative links or with explicite https:// links. In case the site gets served with both https and http you might also use protocol-relative links, e.g. //www.example.com/index.html will be served with http if the current protocol is http and with https if you currently use https.
Related
I recently bought a domain name at OVH for an app I hosted on Heroku. I then paid for the dynos in order to set an automatic SSL certificate.
Everything seems to me working fine:
Domain Status Last Updated
─────────── ─────────── ────────────
mpjrigot.eu Cert issued 2 minutes
mpjrigot.fr Cert issued 2 minutes
But my URL is still in HTTP. What am I missing?
EDIT
I'm using React.js for this app
I also have a Ruby on Rails back but for nom i'm keeping that on the heroku.app, works fine
2nd EDIT
Using react-https-redirect, force-https or react-ssl-redirect...
Basically, chrome tells me that "this is not a safe space", and that this is a fake https that might want to steal the user's passwords and stuff
So I got an SSL that is set on my HerokuApp,
I got a domain on OVH that points to the IP of the app
But the http isn't secure somehow
I really think I missed something obvious as I'm new to this...
You can add HTTPS to your app with the following methods.
Method1 (Recommended)
Since, you're using rails for the backend, you can configure your rails app to always use HTTPS.
in your production.rb add
config.force_ssl = true
More Info: https://help.heroku.com/J2R1S4T8/can-heroku-force-an-application-to-use-ssl-tls
ActionDispatch SSL: https://api.rubyonrails.org/v6.1.4/classes/ActionDispatch/SSL.html
Method2 (Easy Setup)
You can also signup for cloudflare's free plan and easily setup https redirects with cloudflare's 'Always Use HTTPS' or 'Automatic HTTPS Rewrites' feature.
The 'Always Use HTTPS' feature will redirect all http requests on your site to https address.
The 'Automatic HTTP Rewrites' feature will change the HTTP links on your site to HTTPS links.
More Info here:
Always use HTTPS: https://blog.cloudflare.com/how-to-make-your-site-https-only
Automatic HTTPS: https://www.cloudflare.com/website-optimization/automatic-https-rewrite/
Cloudflare's SSL: https://www.cloudflare.com/ssl/
cloudflare dashboard
What am I missing?
Heroku provides a certificate, so you should be able to access your application using https://. However it does not redirect HTTP requests to HTTPS for you:
Redirects need to be performed at the application level as the Heroku router does not provide this functionality. You should code the redirect logic into your application.
Exactly how you do that depends on the language and libraries or framework that you are using. Several common examples are listed in the link I provided above.
If you edit your question to tell us what technology you have used to build your application I'll be happy to add those details to this answer. In case you are using Scala, please see How to disable HTTP requests on Heroku and/or auto-redirect to HTTPS?
solution
I eventually read about Heroku needing a specific host that takes in the address they tell you to point to when setting a domain name...
So I switched to Gandi for my domain name and set the ALIAS to point to said adress
Works like a charm
Hoping this doesn't come across as a stupid question. Server and SSL stuff isn't my forte.
I've got a wildcard SSL cert and on my root domain it works. On one of my subdomains it show securely. But on a second subdomain I get the broken padlock.
www.mydomain.ca - secure
www.subdom.mydomain.ca - secure
www.subdom2.mydomain.ca - broken padlock
Now with the root domain I know its a particular CMS, the first subdom is a Drupal site and the one that is broken right now is hosted in Azure.
I suppose my question is do I need to install a seperate SSL cert on my subdom2? (For all I know it was done to the first subdom before my time). Or is the nature of a wildcard SSL cert to cover anything that's a subdomain - provided that all the content is being served securely on the website?
Update
If anyone comes across this, the issue was our vendor was serving an image that wasn't https. In the end in the issue had nothing to do with my wildcard SSL cert and it looks as though it does in fact cover all subdomains as long as content is being served securely!
If anyone comes across this, the issue was our vendor was serving an image that wasn't https. In the end in the issue had nothing to do with my wildcard SSL cert and it looks as though it does in fact cover all subdomains as long as content is being served securely!
URL in question: https://newyorkliquorgiftshop.com/admin/
When you open the above page, you can see in the console that there are lots of error messages saying "...was loaded over HTTPS, but requested an insecure stylesheet.."
This website was working well until all of a sudden this problem shows up. I am not very familiar with https, but I have contacted with Godaddy and the SSL certificate is valid, and there is no obvious problem with "https://newyorkliquorgiftshop.com". And I am stuck here, I've some experiences with HTTPS website before, if the URL of website's homepage is "https", then every resources it loads is via "https" too. I don't know why my website behave differently and I don't know where to start to solve the problem? Any hint is appreciated especially articles about HTTPS that is related to my problem.(I have done a brief research regarding HTTPS but most of the articles I found are about the basic concepts.)
If you have access to the code (not sure what you built the website using), try using https instead of http for the URL's you use to load your style sheets and script files.
For example one of the errors is
Mixed Content: The page at 'https://newyorkliquorgiftshop.com/admin/' was loaded over HTTPS, but requested an insecure script 'http://www.newyorkliquorgiftshop.com/admin/view/javascript/common.js'. This request has been blocked; the content must be served over HTTPS.
You are requesting the .js file using HTTP, try using HTTPS like so:
https://www.newyorkliquorgiftshop.com/admin/view/javascript/common.js
I use BlueHost for LearnInternetGrow.com and I have all www addresses being redirected to non www. I did this so that my organic search results would start with my domain name.
I recently set up SSL for the site but may not keep it in the long run.
I have backlinks that are hard coded with http://learninternetgrow.com. I want to redirect all types of variations of the address
(http://learninternetgrow.com http://www.learninternetgrow.com https://www.learninternetgrow.com)
to https://learninternetgrow.com. I want to do it this way so that if I get rid of SSL (which comes with a premium) I don't have to get Google to recrawl the site and redo all the backlinks.
I feel like my logic may be faulty. Has anyone used a 301 redirect to send all traffic to a secure version of their site. I started without SSL because the site is just a blog without any sign ins, but I read that SEO can get a boost if I use SSL. So this is really a test to see if the premium is worth the SEO bump. If it isn't I will get rid of it but I want to minimize the work necessary for this test.
Please let me know if you have done a similar test and how you did it. If you started with an http site and upgraded to TLS (SSL) how did you go about doing it without hurting your organic traffic.
The main questions is - When upgrading to SSL on WordPress, should one redirect to Https at the server level or change wordpress settings - WordPRess address URL to https:// or should I do both.
To get that "boost" your https but do done properly :
301 (permanent) redirect
Avoid mixed content
So you need to change the wordpress address in the settings to avoid mixed content, and add the 301 redirect directly in the server configuration if possible.
Wait at least 2 week before start looking for a boots. The boost will be small but don't forget :
https is not about SEO boost, it's about security of your visitor and integrity of your website (some ISP inject ads inside http websites...)
Apologies if this is a duplicate, but I couldn't find a question fitting my exact circumstances.
I am redesigning a site, part of which will require SSL coverage. I have set up SSL with our hosting provider, but this is shared SSL. Whereas our current site is at www.companyname.com, the secure server is at companyname.genericssl-host.com.
I believe the best way to proceed is to simply shift all the web files onto the secure server, whether they need to be secure or not, then redirect www.companyname.com to there. However, the provider informs me that if I do that, the URL in the browser address bar will still read companyname.genericssl-host.com once the redirect completes, and that I would need to edit the htaccess file to make it read good ol' www.companyname.com again.
What does the htaccess file need to contain in order to do this?
Not sure what your hosting provider is referring to, but changing it back to "www.companyname.com" defeats the purpose of using SSL at all. What shows up in the browser's address bar is:
what host the browser is going to send a request to
what URI it will request
the query string if there is any
If you change it back to www.companyname.com, it's going to send a non-SSL request to that host, which defeats the purpose of redirecting it to SSL in the first place.
You need to buy a certificate for *.companyname.com and install if on a host specific to your server.