Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
philwareham wrote #309949:
The next thing you’ll probably be punished for in indexing is going to be older TLS versions (and/or any SSL enabled) on your server. You really need to be running TLS 1.2+ from here on out, which is much more secure. We’re going to have to eventually move the Textpattern sites to a new host and server since the Joyent server we have is stuck on TLS 1.0 with no possible upgrade path (and runs an obsolete PHP version for that matter).
The one good thing I could say about Joyent was the free hosting. I guess I won’t saying anything at all.
You can test your server here to see what TLS version it is running.
michaelkpate.com scored an A thanks to Let’s Encrypt and Dreamhost.
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
Caddy 0.10.12 Released with ACMEv2 and Wildcard Certificates.
it can obtain and renew wildcard certificates for you.
Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
colak wrote #310445:
Caddy 0.10.12 Released with ACMEv2 and Wildcard Certificates.
anyone know how to use this on our webfaction domains?
…. texted postive
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
Mozilla – Firefox, seems to want go one step further and make some new features only available when a site is served over HTTPS, according to this blog post. I wonder how that will go when developing locally.
Where is that emoji for a solar powered submarine when you need it ?
Sand space – admin theme for Textpattern
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
phiw13 wrote #310652:
I wonder how that will go when developing locally.
A few years before, they said it was all going to be fine:
What about development/corporate environments?
You’ll be able to configure the browser to work for these cases. The notion of “secure” enforced by the browser in this case will be the one defined by the W3C’s Privileged Contexts specification, which we expect will have a provision for local policy that is, for the user to configure a certain context as explicitly trusted. Combine that with the existing mechanisms for adding trusted roots, and it should be straightforward for a developer or IT guy to set up a secure environment, like Mozilla does
The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.
Txp Builders – finely-crafted code, design and Txp
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
phiw13 wrote #310652:
I wonder how that will go when developing locally.
FTA (emphasis mine):
Effective immediately, all new features that are web-exposed are to be restricted to secure contexts.
Stick to .local (RFC6762) and I’m confident it’ll work.
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
Hmm… My web host, crosswinds.net, has some certificates but those expired April 2. I emailed them on April 3 and haven’t heard back yet.
My sites have div menus for navigation. Some sites have no problems showing them, some sites only show the main article with menus, and some don’t do that much. One older sub-domain doesn’t show the menus, the rest of the odler sites work fine. The newer sites, set up and working before April 2, worked until April 2, 2018.
From looking in my cpanel, all certs have expired for my domain and sub-domains. So I am very uncertain as to just why the sites’ menus work and dont work.
I was looking at buying my own certs, but while $9 isn’t bad, it apparently is only for my domain and doesn’t cover subs. Looks like it would cost me over $200 per year, but I’m on Social Security. I don’t see the need for them anyway. I’m the only user, my usernames for editing aren’t my personal name, and no visitor data is kept except the visitor logs which don’t keep longer than 21 days.
This just seems not needed for game maps I give away free.
FF, Opera, and Edge don’t want me to look at my own web sites. Argh. ( I can log in okay and Publish, etc. but this ‘are you sure ?’ and ‘make a permanent exception’ shouldn’t be necessary.)
Apologies for the venting. I really want to get this fixed.
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
I found my site navigation menu problem to be articles were going to archive instead of article. Changing them back to article, the menus show up again. This is under Presentation -> Sections -> Page.
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
colak wrote #310445:
Caddy 0.10.12 Released with ACMEv2 and Wildcard Certificates.
bici wrote #310446:
anyone know how to use this on our webfaction domains?
Maybe I should bump this one:)
Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
colak wrote #312905:
Maybe I should bump this one:)
I haven’t seen the wildcard version yet, but the will-in-wi method does work for multiple named domains and subdomains, so you can set up and renew one SSL certificate covering multiple sites which saves time considerably. You have a config file with your named subdomains, making it fairly straightforward to manage. He’s recently updated his script and the instructions so it might be worth looking at it again.
TXP Builders – finely-crafted code, design and txp
Offline
Re: Non-HTTPS Sites Labeled "Not Secure" by Chrome
jakob wrote #312906:
I haven’t seen the wildcard version yet, but the will-in-wi method does work for multiple named domains and subdomains, so you can set up and renew one SSL certificate covering multiple sites which saves time considerably. You have a config file with your named subdomains, making it fairly straightforward to manage. He’s recently updated his script and the instructions so it might be worth looking at it again.
Thanks so much… I’ll dig into it.
Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.
Offline