Questions tagged [https]

HTTPS is the secure version of the hypertext transfer protocol (HTTP). It usually uses port 443 and is powered by the TLS (formerly SSL) cryptographic protocol.

Filter by
Sorted by
Tagged with
118
votes
5answers
209k views

Moving from HTTP to HTTPS in Google Search Console

I'm moving from HTTP to HTTPS for my entire site. The site is currently added to Google Search Console (formerly Google Webmaster Tools) as www.example.com and all the pages are indexed without using ...
92
votes
5answers
13k views

How do I transition to SSL without affecting PageRank?

Here at Stack Exchange we're working on moving all traffic to SSL. The reason we're not doing logged-in-users only is that one side of the login divide would suffer a redirect from Google every time. ...
61
votes
5answers
7k views

Why should I pay for an SSL certificate?

I paid for an SSL certificate from Namecheap, I think it was certified by ComodoSSL. It cost me 7$, it took them a week to activate and I had to do it myself from SSH while editing my site's ...
55
votes
12answers
6k views

What is the benefit of forcing a site to load over SSL (HTTPS)?

Let's say I have a large content-only site; no login or logout, no usernames, no email addresses, no secure area, nothing secret on the site, nada. People just come to the site and go from page to ...
40
votes
5answers
8k views

What events caused mass migration to HTTPS?

For several years I see that Google, Facebook, etc start serving (and even redirect to) content via HTTPS. Serving sites that prompts passwords in insecure HTTP was wrong even in 1999 but it ...
39
votes
6answers
3k views

Are the different types of SSL certificates a bit of a scam?

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm going ...
33
votes
7answers
42k views

Why is godaddy HTTPS/SSL certification so much cheaper than digicert, thawte, and verisign?

I am a novice on HTTPS/SSL but GoDaddy charges $12.99 and Digicert, thawte, and Verisign charge $100-1000+ for SSL certificates. I must be missing something on the quality of the encryption or ...
30
votes
4answers
7k views

What are the benefits of a more expensive SSL certificate?

I've been comparing prices of different SSL certificates and found a massive difference in prices between different providers. If we take http://www.namecheap.com/learn/other-services/ssl-...
28
votes
2answers
86k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
28
votes
4answers
4k views

Is using only HTTPS bad in a SEO perspective?

I would like to set up a new business site. I plan to direct www.example.com to example.com and only use that domain. My plan is also to only use HTTPS and not HTTP. Does this affect the SEO for the ...
26
votes
5answers
7k views

How do I get my site verified such that it shows a green box in Chrome's address bar?

How do I get my site verified by Google Chrome so it has the green box in the address bar? I honestly don't know how to do this. Also, do I have to ask Google to verify it?
26
votes
3answers
36k views

IIS 7 Require SSL automatically redirect to https://

I've configured IIS 7 to require SSL. I'm wondering if I can automatically redirect non-ssl requests to be encrypted. For example, if a user types in http://domain.com, can IIS redirect the request ...
24
votes
1answer
15k views

Which browsers support SNI?

Because of the way web servers and SSL work, previously a dedicated IP address was required for running an SSL certificate on a domain. But with a new technique (SNI, abbreviation for Server Name ...
23
votes
6answers
35k views

Is unique IP address a must for SSL?

The shared hosting company told me that if I buy an IP address then it will be applicable for the addon domains too. What does it mean? Then the SSL certificate won't work since there will be more ...
22
votes
5answers
859 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
17
votes
2answers
11k views

StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome

My existing HTTPS certificate is expiring soon so I bought a new one. I'm having a very hard time installing it properly though. I have a wildcard certificate from StartSSL for *.deadsea....
17
votes
8answers
13k views

Huge drop [50%] in traffic after HTTPS move

Currently look after 3 websites. I changed one of them to be HTTPS as it's ecommerce, however have seen a huge drop in organic traffic since this was implemented. Went from around 800 impressions to ...
16
votes
2answers
15k views

Is there a way of using HTTPS with Amazon's CloudFront CDN and CNAMEs?

We use Amazon's CloudFront CDN with custom CNAMEs hanging under the main domain (static1.example.com). Although we can break this uniform appearance and use the original whatever123wigglyw00....
16
votes
2answers
22k views

How can my organization become a Root CA?

I'm the founder of a little non-profit French organization. Currently, we're providing free web and shell hosting. Is there a way to become a Trusted Certificate Authority, in order to give free SSL ...
16
votes
2answers
592 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
15
votes
1answer
4k views

Should I submit https:// and http:// in Google Search Console both with and without the www?

In my site I'm redirecting everything (http://, http://www., https://) to https://www.example.com. Google webmaster tools says: Make sure you add both "www" and "non-www" versions for your site. Also,...
14
votes
5answers
26k views

HTTPS connection is “not safe” due to images

I am currently working on a website and I have successfully installed my SSL certificate. The GeoTrust SSL/TLS checker confirmed that the certificate chain (including CA) is properly installed. ...
14
votes
1answer
844 views

Cost of using SSL

I am wondering on the cost of using SSL sitewide. It would be for a standard LAMP site. I know that this will be dependent on the many factors but, can some give me an 'average' or 'guesstimate!'. By ...
14
votes
1answer
8k views

How can I set Webmaster Tools to “Fetch as Google Bot” using SSL?

I have page which requires SSL so the page is https://. I want to fetch this page as google bot inside of google webmasters' diagnostic tools however Google, from what I can tell, only allows http ...
12
votes
4answers
753 views

Does Googlebot support TLS v1.2? If not, what will my TLS v1.2-only site look like to it?

I currently redirect all non-HTTPS connections to HTTPS, and support TLS v1, TLS v1.1, and TLS v1.2. I reconfigured my testing server to accept only a very limited and secure cipher suite and TLSv1.2 ...
12
votes
1answer
11k views

Multiple IP addresses for one SSL certificate

Is it possible to register an SSL Certificate for Multiple IP addresses? This is needed for one of my sites; which runs on two different servers with different IP addresses. One server is live; while ...
11
votes
6answers
47k views

How can I pass referrer header from my https domain to http domains?

My website is 100% https. I have links to other http domains. The referrer header is not set when linking from a https page to a http page. From http://en.wikipedia.org/wiki/HTTP_referrer If a ...
11
votes
6answers
875 views

SSL certificate provider

I need a SSL certificate for a new site I'm building and I have to choose a SSL provider. What to look for when choosing and what's your experience dealing with them? Thanks!
11
votes
3answers
20k views

How to prevent access to website without SSL connection?

I have a website that has an SSL certificate installed, so that if I access the website using https instead of http I will be able to connect using a secure connection. However, I have noticed that I ...
11
votes
4answers
1k views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
11
votes
1answer
2k views

Is it really a security problem to have non secure assets on an ssl page?

My understanding is that this is just an example of being overly cautious, but if my checkout form contains an unsecure asset on it, that doesn't endanger anybody's credit card numbers from being ...
11
votes
3answers
5k views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare lets you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
11
votes
3answers
14k views

Google indexes my site as https as opposed to the correct http

Over the last month, the home page of my website hosted on Media Temple's grid server and has been appearing in google listings as an https website. I have never requested or needed the extra ...
11
votes
4answers
712 views

Are free SSL certificates secure?

How is it that some SSL certificates are free? What does that mean? Are they secure or not?
11
votes
2answers
213 views

Choosing which domain to secure

We've got a website that is served on both www.example.com and just example.com - we've never done any sort of forcing users from one domain to the other, so if they land on example.com then that's ...
11
votes
5answers
17k views

Why would you use document.location.protocol instead of plain // prefixed urls?

For instance Google Analytics uses document.location.protocol in the boilerplate for tracking: <script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-XXXXX-X']...
11
votes
6answers
8k views

Forcing SSL and www in .htaccess

I'm looking for a way to force SSL and www. I've been able to force both separately but together I keep running into redirection issues. The following code works when handling a URL in this format: ...
11
votes
2answers
2k views

Using wildcard certificates for multi-server deployment

Currently we are deploying a beta API for our services and we want that all request/responses from the API works over https. I'm confused about using wildcard certificates for both api and www urls. ...
10
votes
6answers
2k views

HTTPS for entire site

I'm working on a fairly standard web site with public content plus personal/customized content for registered users. I know I need to use HTTPS when users are logging in or sending credit card ...
9
votes
3answers
5k views

Are drops in Google ranking common after switching to https?

About a week ago I made the switch to https on one of my sites. I'm positive I did everything right. Properly setup 301 redirects from http to https versions. Added and verified https version in ...
9
votes
2answers
22k views

How to optimize the load time of initial connection and SSL handshake phase of a web page on a 3G network?

My website www.example.com(SSL enabled) is hosted on Amazon EC2 shared hosting. It loads faster (load time < 2 seconds) on a wifi/broadband connection. Issue is on 3G network in mobile**(H mode and ...
9
votes
2answers
2k views

Is incorrect to have the HTTPS version of the sitemaps.org URL in the xmlns sitemap schema?

I have the schema with this: <sitemapindex xmlns="https://www.sitemaps.org/schemas/sitemap/0.9"> Is it correct or should be: <sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0....
9
votes
1answer
2k views

Should we get an EV Certificate?

Our regular SSL provider is offering EV certificates for under $US200, and it just so happens that the certificate for our B2B e-commerce site is expiring in a month (which should give us enough time ...
9
votes
2answers
329 views

User contributed images on a HTTPS site without mixed content warnings

I have a forum where, like most forums, users can post images. I've set up HTTPS across the site, but of course most external images are linked using HTTP, not HTTPS. So loading the forum over HTTPS ...
8
votes
3answers
20k views

htaccess redirect non-www to www with SSL/HTTPS

I want a rewrite rule that redirects everything to https:// AND www. For example http://example.com should be going to https://www.example.com This is what I have: RewriteEngine On RewriteCond %{...
8
votes
2answers
575 views

Can I use the same SSL cert for HTTPS and FTPS

I am looking to get an extended SSL certificate for a server that is handling one of my subdomains. Can I use the same certificate for https://sub.example.com and ftps://sub.example.com, assuming that ...
8
votes
2answers
5k views

How to serve static content without https in a secure site?

I want to serve static content from my site but my site is https-only. My static http server only serve http content (non https) but many IE users are complaining about being unable to log into. What ...
8
votes
2answers
715 views

Bing and lack of SNI support

I invested a few hours yesterday investigating why my site is ranked highly in Google but not indexed at all in Bing. Trial and error using the "Fetch as Bingbot" tool led me to the conclusion that ...
8
votes
1answer
4k views

Secure and non-secure Schema.org Markup?

Is it possible to have schema.org itemtypes for both secure and insecure ports? I run a static-ish site made in Jekyll, and am implementing Schema.org on the individual pages. As a result, I'm ...
8
votes
3answers
5k views

HTTPS best practices for SEO and usability

Consider a page, http://example.com, which can be viewed both publicly and when a user authenticates. Now suppose you enable HTTPS for every page when a user logs into your website, but only when they ...