New Article: Convert an RPi based website from HTTP website to HTTPS.

[cpc464]

Hi

To who it may concern, I have just published a new article on how to convert a RPi/Apche based website from http to https. It is designed to be simple as possible and uses a free digital certificate from Let's Encrypt.

http://unixetc.co.uk/2017/06/04/using-a ... eb-server/

Cheers,
Jim

[Heater]

That must be the wrong link. It leads to a page from last year with no mention of letséncrypt on it.

Clicking around there I don't find any mage the mentions letsencrypt.

[DirkS]

That must be the wrong link. It leads to a page from last year with no mention of letséncrypt on it.

Clicking around there I don't find any mage the mentions letsencrypt.

Found this link at the bottom of the page OP linked to: http://unixetc.co.uk/2018/05/13/how-to- ... -to-https/

[Heater]

OK, I got it. It's a great idea to encourage people to use HTTPS everywhere and using Letsencrypt is a good way to do it.

A couple of points:

1) I see no mention of renewing certificates.

Having installed a Letsencrypt certificate it will expire after three months and you won't be able to get into your site. One can either renew the cert manually every three months or automate it. I have a weekly cron job that runs the "certbot renew" command. It also stops my nginx server before the renew and then starts it again.

Aside: I got a call in the early hours of this morning telling me that our site was inaccessible. Turned out my cron job failed to renew the cert! I had been running it daily and Letsencrypt has a rate limit on renewals. I hope running it weekly is better.

2) It talks about having both http and https versions of the site available. This is a bad idea and should be discouraged.

If you care at all about security, even if it is only to stop random people turning the LEDs connected to your Pi on and off, then having HTTP available awell is a security hole. It's like having two front doors on your house, side by side, one with a lock requiring a key to open it and one that is left open all day long!

If you don't care about security then why are you bothering with HTTPS in the first place?

3) Having HTTPS in place is a good start but it's only the beginning of ensuring your web server is secure.

There are a ton of other things to do to make things secure. Depending on what server and other software you are running and what you are doing. For example have a look at the website security checklists one finds around the net:

For example this lengthy check list, any and all of which could apply to your situation:

https://www.owasp.org/index.php/Web_App ... heat_Sheet


4) Interestingly this article about securing a site with HTTPS is on a site that is not secured with HTTPS. Also running Wordpress!

[cpc464]

Blimey, this is a necro-post and no mistake. Sorry about the wrong link!

The correct link is:
http://unixetc.co.uk/2018/05/13/how-to- ... -to-https/

Cheers,
Jim.

[cpc464]

OK, I got it. It's a great idea to encourage people to use HTTPS everywhere and using Letsencrypt is a good way to do it.

A couple of points:...

Hi Heater, regarding point (1), the article is simply about how to convert an existing HTTP website to HTTPS. This is clearly denoted by the title and explained again in the introduction. It is aimed primarily at Pi users. It is not a guide for professionals on how to maintain commercial websites. If you need that, many courses resources are available.

Regarding your failed cron job and callout, yes I know Letsencrypt do rate limiting. Dare I say it, you ought to have known it too, or discovered it in testing before unleashing a cron job.

Regarding your point (2), did you read the article ? The http/https ambiguity is discussed under "Notes".

Regarding your point (3), remember the title of the piece is "how to convert a website from http to https". Your points are beyond the article's scope. See my response to point (1), above.

Regarding point (4), unixetc.co.uk remains in HTTP and not HTTPS, so that it can still be accessed from within secure organisations such as banks. They routinely block websites based on a number of criteria, one of which is the origin and level of the certificate. Specifically, they block letsencrypt secured sites.



Jim

[hippy]

Regarding point (4), unixetc.co.uk remains in HTTP and not HTTPS, so that it can still be accessed from within secure organisations such as banks. They routinely block websites based on a number of criteria, one of which is the origin and level of the certificate. Specifically, they block letsencrypt secured sites.

That blocking policy seems slightly bizarre to me. While a site using https is no guarantee of it not being of a dubious or malicious nature, it doesn't seem to me that https sites should be treated as being more likely to be so than a plain old http site.

The end result seems to be that perfectly legitimate https sites get blocked while decidedly dodgy http sites remain accessible.

[cpc464]

Hi Hippy, I think the Banks' logic goes something like this: HTTPS is meant to be trustworthy, so they (the bank) will carefully check the certificate of any site purporting to offer HTTPS. They will also check that the owing organisation is legitimate. Before trusting somebody with something, you check them out. On the other hand, HTTP is not secured, and is not pretending to be. It is not asking for any particular trust level, so is allowed.

ie. The amount you check somebody out depends on the level of trust you intend to have in them.

... and yes, some legitimate HTTPS sites, eg those secured with Letsencrypt, get blocked.