You have been taken by the Mists

Author Topic: SSL Security Certificate missing on this website  (Read 1856 times)

Marzipanic

  • New to the Mists
  • *
  • Posts: 1
SSL Security Certificate missing on this website
« on: August 01, 2018, 07:41:44 PM »
Hi all!

Just a heads up--because there does not appear to be an SSL cert installed for this website, browsers report registration for the forums as unsafe (which it is); passwords can be mined across the wire by those who know how. Would a web admin be willing to resolve this by adding a cert?

Free certs can be acquired from Let's Encrypt: https://letsencrypt.org/

An additional suggestion/request would be to update the website so that it redirects from HTTP to HTTPS (SSL) also, just in case anyone had it bookmarked under the open protocol.

Thank you for helping to keep the web safe!

Blight

  • Dark Lord
  • *****
  • Posts: 624
Re: SSL Security Certificate missing on this website
« Reply #1 on: August 01, 2018, 11:11:31 PM »
Oh, look. A bot.
Just another lesson from the School of Hard Knocks... PHD!

Iluvatar / Madness

  • Ex-Community Council
  • Developers
  • Dark Power
  • *
  • Posts: 3487
  • The Madness
Re: SSL Security Certificate missing on this website
« Reply #2 on: August 01, 2018, 11:30:49 PM »
It's not a bot, he actually talked about this on the Discord and was told to post it on the forum ;)
« Last Edit: August 01, 2018, 11:34:41 PM by Iluvatar »
Iluvatar
Iluvatar-2
Iluvatar NCE
Madness

Exordium

  • Developers
  • Dark Power
  • *
  • Posts: 1806
Re: SSL Security Certificate missing on this website
« Reply #3 on: August 05, 2018, 12:06:44 PM »
Yeah, should have SSL set up. There's been some informal talk about looking over the website at some point.

At the moment we don't fully conform to the current EU data privacy laws either...

DrXavierTColtrane

  • Dark Lord
  • *****
  • Posts: 737
Re: SSL Security Certificate missing on this website
« Reply #4 on: August 05, 2018, 05:23:08 PM »
SSL is set up, but the certificate is invalid.

https://www.nwnravenloft.com/forum/index.php

That works, but the browser warns that the name on the cert is not correct. If the user confirms a security exception, thereafter SSL is usable.

Fixing it to be correct requires only replacing the certificate with a properly generated one having the correct host name.
For everything that's lovely is
But a brief, dreamy, kind delight.

Soren / Zarathustra217

  • Lead director, main scripter, nutty geek, Community Council
  • Administrator
  • Dark Power
  • *
  • Posts: 12979
Re: SSL Security Certificate missing on this website
« Reply #5 on: September 04, 2018, 04:25:09 AM »
We are now converted to full SSL - thanks for reminding us!

Super Sugar

  • Undead Master
  • ****
  • Posts: 275
Re: SSL Security Certificate missing on this website
« Reply #6 on: September 04, 2018, 04:47:53 AM »
Woop!  Looks to be working very well!

Super Sugar

  • Undead Master
  • ****
  • Posts: 275
Re: SSL Security Certificate missing on this website
« Reply #7 on: September 04, 2018, 05:01:09 AM »
Just some added detail, the cert might be reporting mixed-content (not 100% secure).  I went through the code myself and it seems to be reporting this because there's some 'http' specific links to w3.org and some other un-important things.  Nothing to be worried about.