http to https in textpattern

lythande · 2018-05-22 21:41:19

Hi,

I am wondered, why I don’t find a “how to” for switch a webseite with textpattern from http to https?
I have try on my live-website, but it seems, that I have to need make more steps for set the https inide, because my css wasn’t shown…

With the new EU-DSGVO I must have set my website with an SSL-Certificate (SSL-Zertifikat) and a https:// instead http://
(very important for contact-formulars and another formulars…)

I hope, someone can help me for the next steps? (I have a SSL-Certificate for this one domain)

And is here maybe a second “How To” for making a new website (on the test-site) with https:// for the live-site and then switch the test-site to the live-site? My problem: the ssl-certificate is only for www.domain.tld and not for subdomain (subdomain = testsite).
I dont know, would I get errors, because there is not ssl-certificat, if I look on the test-site-domain?

Best Regards
Lythande

michaelkpate · 2018-05-23 00:25:36

All I have been doing is using this .htaccess file. I don’t remember exactly where I got the code from.

Edit: I changed this to match Jakob’s suggestions below.

# BEGIN Textpattern
#DirectoryIndex index.php index.html

#Options +FollowSymLinks
#Options -Indexes
#ErrorDocument 403 default

<IfModule mod_rewrite.c>
    RewriteEngine On
    #RewriteBase /relative/web/path/

    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^(.+) - [PT,L]

    RewriteCond %{REQUEST_URI} !=/favicon.ico
    RewriteRule ^(.*) index.php

    RewriteCond %{HTTP:Authorization}  !^$
    RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]
</IfModule>

<IfModule mod_mime.c>
    AddType image/svg+xml  svg svgz
    AddEncoding gzip       svgz
</IfModule>
# END Textpattern

There are several threads in the forum but the most recent is Non-HTTPS Sites Labeled ‘Not Secure’ by Chrome.

lythande · 2018-05-23 05:39:18

Hi michaelkpate,

much thanks, it works. So easy? :-D

How I can made my textpattern-login in this site with ssl / https too?

Lythande

jakob · 2018-05-23 05:55:32

Hi Lythande,

Step 1: add this line to your config.php:

define('PROTOCOL', 'https://');

That makes Textpattern create https:// links wherever you use txp:site_url or other automatically linking txp tags.

Step 2: In your .htaccess file (the dot means it’s hidden by default so you need to have “show hidden files” in your ftp program to see it), add these lines similar to what Michael said:

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

except, that I’d add these near the top after RewriteBase.

There are various similar ways of doing that, like what Michael suggested. The one I’ve pasted here is from the HTML5 boilerplate.

Step 3: If you’ve coded your site brilliantly, you may already see the padlock icon in your address bar everywhere. But if you’re like me and sometimes manually construct links, you’ll need to go through your code and see if you’ve written http:// manually in your code and change that to https://.

Everything that you include in your site needs to be included as https, i.e. all css, all images, all javascript. I even had to replace some third-party plugins that themselves linked to other sources using http. It only needs one item of content that is not accessed via an encrypted connection and you won’t see the padlock (or you get the padlock with provisos). Sites that you link to externally (like in a link list) can still be http://.

And yes, you need a certificate for each subdomain, or a certificate that also covers the subdomain names. Paid SSL certificates can be ‘wildcard’ certificates and cover subdomains, but they are generally expensive. Free certificates from Let’s Encrypt will depend on how your host handles them. I use all-inkl. in Germany and have to submit a certificate request for each subdomain individually, but it’s just a two-click setting. On Webfaction, a UK-US host, more manual work is involved but you can request one certificate to handle a whole batch of domains and subdomains. Let’s Encrypt have recently added a wildcard certificate facility, but many hosts don’t yet support it.

I hope that helps. BTW: did you get your other sites working?

EDIT: Ah right, you got it working already. Well done! Your code must be nice and clean ;-)

lythande · 2018-05-23 06:38:23

Much thanks, Jacob!
All works and my login is with https too! :-D

sacripant · 2018-05-23 18:23:55

Very usefull tips Julian. Thanks.
It would be great to have a txptips about textpattern and https.

jakob · 2018-05-23 19:50:48

Jonathan had already written part of that as a txp tip: Site links in SSL but not all of it. (A note about forcing https in htaccess is shown in the preview of related DISQUS comments, but I don’t see that as an actual comment to the thread so it’s only half-readable).

That said, I don’t mind expanding on that and I’m sure Jonathan won’t mind, but I’m no expert on the subject.

@SSL experts: Are there any details I’ve forgotten or got wrong? Anything else I should add?

Vienuolis · 2018-05-24 16:32:05

Nothing required to do for Textpattern CMS on Hiawatha webserver. The simple string is sufficient there for a virtual host: RequireTLS = yes.

Hiawatha also comes with free DST CA certificate request, revoke, and renew automation via Letsencrypt.org.

I have also forced TLS for editors, while leaving encryption optional for visitors — to the same website.

bici · 2018-08-28 20:07:49

michaelkpate wrote #311995:

All I have been doing is using this .htaccess file. I don’t remember exactly where I got the code from.

Edit: I changed this to match Jakob’s suggestions below.

# BEGIN Textpattern...

There are several threads in the forum but the most recent is Non-HTTPS Sites Labeled ‘Not Secure’ by Chrome.

causes
Error: 500 Internal Server Error¶

gaekwad · 2018-08-29 14:50:31

bici wrote #313681:

causes
Error: 500 Internal Server Error¶

Can you post the entire .htaccess here that causes the 500 error?

bici · 2018-08-29 15:34:41


# BEGIN Textpattern
#DirectoryIndex index.php index.html
#Options +FollowSymLinks
#Options -Indexes
#ErrorDocument 403 default
<IfModule mod_rewrite.c>
    RewriteEngine On
    #RewriteBase /relative/web/path/
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^(.+) - [PT,L]
    RewriteCond %{REQUEST_URI} !=/favicon.ico
    RewriteRule ^(.*) index.php
    RewriteCond %{HTTP:Authorization}  !^$
    RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]
</IfModule>
<IfModule mod_mime.c>
    AddType image/svg+xml  svg svgz
    AddEncoding gzip       svgz
</IfModule>
# END Textpattern

Last edited by bici (2018-08-29 15:45:23)

bici · 2018-08-29 15:47:04

P.S.
Today when i tried it again it complained of not having an certificate.
I thought that the code was a way of doing secure sites without teh certificate. perhaps i am wrong

Textpattern CMS

Textpattern CMS support forum

#1 2018-05-22 21:41:19