Why is https:// not supported here?

[mintsauce82]

It's as simple as that. Whether you're a bank or an Amiga forum, it should be encrypted.

Hear hear. It is a huge concern that the site doesn't use HTTPS at all. Having to log in over port 80 is a no-no.

It's a sad reality that if you want to do anything on the net these days, it's a good idea to encrypt. Common sense even. To do otherwise is a massive security risk.

If that means leaving Amigas unable to log in, then so be it. Security is much more important. Browse the forum on a modern computer.

[gimbal]

He he, something tells me our overlord is activating https right now because I'm seeing errors to that effect

[RCK]

Done !

You can now access EAB with or without HTTPS, it's up to you
http://eab.abime.net/
https://eab.abime.net/

[DamienD]

Nice; many thanks RCK

[mintsauce82]

Excellent! Very much appreciated, thank you RCK

[gimbal]

For some reason Chrome is not fully happy with it though, it claims the site is not fully secure without really telling why.

[solarmon]

A comprehensive SSL check can be done at:

https://www.ssllabs.com/ssltest/anal...ime.net&latest

It looks like the main issue is that the web server is still offering weak ciphers and protocols (like TLS 1.1 and 1.2)

[demolition]

Originally Posted by gimbal

For some reason Chrome is not fully happy with it though, it claims the site is not fully secure without really telling why.

Firefox says that while the certificate is valid for the main page, it contains elements from outside *.abime.net which means that it could be leaking information. Hence it will not show a green pad lock.

[RCK]

Originally Posted by gimbal

For some reason Chrome is not fully happy with it though, it claims the site is not fully secure without really telling why.

It's because of HOL's search box which is not in HTTPS
Look at one simpler site like https://mods.abime.net/, no problem.

This will be better when HOL will be moved on new server.

[RCK]

Originally Posted by solarmon

A comprehensive SSL check can be done at:

https://www.ssllabs.com/ssltest/anal...ime.net&latest

It looks like the main issue is that the web server is still offering weak ciphers and protocols (like TLS 1.1 and 1.2)

This is not the main problem, and I want to support weak ciphers for old browsers.

[gimbal]

It's clear, the boss is on it.

One thing I did notice on the ssl labs page is that the SSL certificate expires in only three months, that seems a little short. But maybe that's just how Let's Encrypt operates? I don't actually have any experience with them.

[nogginthenog]

Yes, that's how Let's Encrypt works. Generally you install a job to auto-renew every 30 days or so.

[cloverskull]

Thanks!