Author Topic: SSL Security Certificate missing on this website  (Read 319 times)

Marzipanic

  • New to the Mists
  • *
  • Posts: 1
SSL Security Certificate missing on this website
« on: August 01, 2018, 07:41:44 PM »
Hi all!

Just a heads up--because there does not appear to be an SSL cert installed for this website, browsers report registration for the forums as unsafe (which it is); passwords can be mined across the wire by those who know how. Would a web admin be willing to resolve this by adding a cert?

Free certs can be acquired from Let's Encrypt: https://letsencrypt.org/

An additional suggestion/request would be to update the website so that it redirects from HTTP to HTTPS (SSL) also, just in case anyone had it bookmarked under the open protocol.

Thank you for helping to keep the web safe!

Blight

  • The Underworld
  • Dark Lord
  • *****
  • Posts: 595
Re: SSL Security Certificate missing on this website
« Reply #1 on: August 01, 2018, 11:11:31 PM »
Oh, look. A bot.
Just another lesson from the School of Hard Knocks... PHD!

Iluvatar

  • Someone
  • Developers
  • Dark Power
  • *
  • Posts: 1874
  • I'm one of Strahd's subjects
Re: SSL Security Certificate missing on this website
« Reply #2 on: August 01, 2018, 11:30:49 PM »
It's not a bot, he actually talked about this on the Discord and was told to post it on the forum ;)
« Last Edit: August 01, 2018, 11:34:41 PM by Iluvatar »

~ Iluvatar / Iluvatar-2 / Iluvatar NCE

Exordium

  • Developers
  • Dark Power
  • *
  • Posts: 1732
Re: SSL Security Certificate missing on this website
« Reply #3 on: August 05, 2018, 12:06:44 PM »
Yeah, should have SSL set up. There's been some informal talk about looking over the website at some point.

At the moment we don't fully conform to the current EU data privacy laws either...

DrXavierTColtrane

  • Dark Lord
  • *****
  • Posts: 739
Re: SSL Security Certificate missing on this website
« Reply #4 on: August 05, 2018, 05:23:08 PM »
SSL is set up, but the certificate is invalid.

https://www.nwnravenloft.com/forum/index.php

That works, but the browser warns that the name on the cert is not correct. If the user confirms a security exception, thereafter SSL is usable.

Fixing it to be correct requires only replacing the certificate with a properly generated one having the correct host name.
For everything that's lovely is
But a brief, dreamy, kind delight.

Zarathustra217

  • Lead director, main scripter, nutty geek, Community Council
  • Administrator
  • Dark Power
  • *
  • Posts: 12623
  • a.k.a. Søren
Re: SSL Security Certificate missing on this website
« Reply #5 on: September 04, 2018, 04:25:09 AM »
We are now converted to full SSL - thanks for reminding us!

Super Sugar

  • Undead Master
  • ****
  • Posts: 273
  • For the Avariel!
Re: SSL Security Certificate missing on this website
« Reply #6 on: September 04, 2018, 04:47:53 AM »
Woop!  Looks to be working very well!
I like my sugar with coffee and cream.
 - Imrae Zauviir

Super Sugar

  • Undead Master
  • ****
  • Posts: 273
  • For the Avariel!
Re: SSL Security Certificate missing on this website
« Reply #7 on: September 04, 2018, 05:01:09 AM »
Just some added detail, the cert might be reporting mixed-content (not 100% secure).  I went through the code myself and it seems to be reporting this because there's some 'http' specific links to w3.org and some other un-important things.  Nothing to be worried about.
I like my sugar with coffee and cream.
 - Imrae Zauviir