News for hackers. Stuff that matters.

A comment on A basic guide to when and how to deploy HTTPS.

Re:A basic guide to when and how to deploy HTTPS by bastawhiz on Saturday December 21, 2013 @04:42PM (#6948196)
The biggest barrier to HTTPS is the fact that it's a royal pain in the ass for someone who's not an OPs guy to set up. Unless you're on a shared host or some sort of PaaS that sets your certificates up for you, it's basically a big "go fuck yourself" to get everything installed and configured properly.

Even the Mozilla article linked in the top comment asks you to choose a ciphersuite. Who the heck has time to know and understand what to use, and then figure out how to make it work on their own server?

Oh, the version of Apache you're running combined with the version of OpenSSL that comes pre-installed on your Linux distro causes "Re-negotiate handshake failed" errors? Good luck finding the answer to that on StackExchange.

For most folks that are just trying to ship something, unless security is a huge issue HTTPS doesn't come first because it's simply too much work. And if HTTP works out of the box, there's little incentive to turn on HTTPS.

[ Parent | on HN ]
Re:A basic guide to when and how to deploy HTTPS by velis_vel on Saturday December 21, 2013 @05:10PM (#6948304)
I was able to get basic SSL working with basically no effort just by Googling around for 'SSL nginx'; the Mozilla article doesn't tell you to choose a ciphersuite, it tells you 'use this one unless you know what you're doing'. And then if you scroll down it gives you some configuration directives you can just copy-paste into your browser config file.

I'm not even an ops guy and I was able to get it working for my (granted, fairly simple) site without any pain.

[ Parent | on HN ]
Re:A basic guide to when and how to deploy HTTPS by curiouslearn on Saturday December 21, 2013 @04:51PM (#6948224)
I concur. I wish it were easier to setup.
[ Parent | on HN ]