Implemented SSL / HTTPS Integration

[Ryan Clark]

It would be cool to have SSL Intergration, so if you have an SSL certificate on your website you can allow people to login using that, and view Administrative Areas as well as their User Control Panel through it too.

 

[Jeremy P]

I can't find a setting for it either. The search icon shows on that site for me, so it doesn't appear to be consistent.. but usually Chrome comes up with a badge in the address bar saying some content wasn't loaded because it was insecure.

Using Chromium 25.x on OS X.

Also I did attempt to load the Adsense javascript via https when I first switched to SPDY, and you're right that it works.. but it doesn't (or didn't) load the ad content over a secure connection, especially rich media (image/flash/video) ads.

 

[Deebs]

Weird... I just went through all the Chrome settings I could find and didn't see such a thing in there.

So if you go here: https://forums.suse.com/forum.php the black icon next to search doesn't show (it's served over insecure connection)?

Yeh that works, but your image doesn't load for me. Ah, it looks like it loaded insecure content from the same tld domain but blocked it from others:

[blocked] The page at https://forums.suse.com/forum.php ran insecure content from http://yui.yahooapis.com/combo?2.9.0/build/yuiloader-dom-event/yuiloader-dom-event.js&2.9.0/build/connection/connection-min.js.
This browser is AJAX compatible

vbulletin-core.js:11​

The page at https://forums.suse.com/forum.php displayed insecure content from http://www.suse.com/common/img/forum_search.jpg.
Firing System Init

vbulletin-core.js:11​

Fire vB_XHTML_Ready

vbulletin-core.js:11​

Fetch Cookie :: vbulletin_collapse (null)

vbulletin-core.js:11​

Failed to load resource: the server responded with a status of 404 (Not Found)

https://forums.suse.com/common/inc/foresee/foresee-surveydef.js​

 

[Jeremy P]

Relevant Chrome documentation on loading insecure content http://support.google.com/chrome/bin/answer.py?hl=en&answer=1342714

 

[digitalpoint]

I can't find a setting for it either. The search icon shows on that site for me, so it doesn't appear to be consistent.. but usually Chrome comes up with a badge in the address bar saying some content wasn't loaded because it was insecure.

Using Chromium 25.x on OS X.

Also I did attempt to load the Adsense javascript via https when I first switched to SPDY, and you're right that it works.. but it doesn't (or didn't) load the ad content over a secure connection, especially rich media (image/flash/video) ads.

Maybe you are thinking of JavaScript not running/loading over insecure connections? That IS the case... but static content (images, CSS, etc. will still load). But when it comes down to it, you should be able to load all JS on your site via HTTPS (AdSense, Google Analytics, social media buttons, etc. all work over HTTPS).

Maybe AdSense over HTTP was screwy at one point, but it definitely loads all secondary ad content securely for me... Example... (see image-based AdSense is there, address bar still registers as fully secure, etc.)

As far as the message from Chrome, are you sure you aren't seeing a message that says content WAS loaded, just insecurely?

 

[digitalpoint]

Yeh that works, but your image doesn't load for me. Ah, it looks like it loaded insecure content from the same tld domain but blocked it from others:

Don't think it's the TLD, I just think it's the fact that it's JavaScript...

Here's a different test...

https://www.vbulletin.com/forum/showthread.php/414898-Image-test-over-HTTP

Hotlinked image over non-secure, from different TLD.

 

[Jeremy P]

You're 100% correct DP. It's just javascript that's prevented from loading, insecure images just display triangles and Adsense is working just fine serving everything over a secure connection. Just reconfigured my site to serve everyone over https+spdy.

It looks like it was a 3rd party captcha addon that was using insecure JS and causing the warning.. duh Should have checked developer toolbar more closely..

Sorry to everyone for dragging this off-topic.

 

[Mouth]

Certainly does
http://nginx.org/patches/spdy/

Just FWIW my production site is setup using SPDY (https, via nginx) for all logged-in members.

1. Is there a binary repo for debian with nginx+spdy? Don't fancy performing a source compile

2. How do you manage to have https for logged-in members? Do you set the logon page somewhere in options to https and they remain via https after that? Haven't seen anywhere to be able to designate url for logon page(s).

 

[Jeremy P]

1. Is there a binary repo for debian with nginx+spdy? Don't fancy performing a source compile

2. How do you manage to have https for logged-in members? Do you set the logon page somewhere in options to https and they remain via https after that? Haven't seen anywhere to be able to designate url for logon page(s).

1) Chris Lea has built an nginx-devel package with SPDY. https://launchpad.net/~chris-lea/+archive/nginx-devel You could use that until it's in core.

2) Custom code, which unfortunately I won't be releasing. I just serve the whole site over https now since Adsense and everything works.

 

[Mouth]

1) Chris Lea has built an nginx-devel package with SPDY. https://launchpad.net/~chris-lea/ archive/nginx-devel You could use that until it's in core.

Thanks, but that's Ubuntu, not Debian!?

 

[Jeremy P]

Thanks, but that's Ubuntu, not Debian!?

Ugh, I'm sorry. I'm not 100% awake yet. I run Ubuntu LTS. I haven't been able to track down a package for Debian thus far.

 

[digitalpoint]

One interesting thing I just noticed about SPDY... it will use the same connection for multiple hosts (even if they are completely different domains) if it can. I think "if it can" entails the same SSL certificate on the same front-end gateway.

For example, all the digitalpoint.com sub-domains share the same SPDY connection with dpstatic.com sub-domains (my cookieless domain for serving static content). I assume it's to eliminiate the SSL handshake needed for each host when it's not necessary.

Everything related to Google seems to be using SPDY these days (Google search, Gmail, Google Analytics, AdSense, YouTube, Google+, etc.), as is Twitter and most everything by Automattic (WordPress domains, Gravatar, etc.)

 

[Andy.N]

If you run Chrome, type this on the address bar to check SPDY status chrome://net-internals/#spdy
You can also use this site to check http://spdycheck.org/

I just get spdy installed and working on my site. Too bad nginx can only support up to spdy/2
If you look at the picture above, everything from Google is using spdy/3.

 

[digitalpoint]

I suspect they will have SPDY/3 working soon...

 

[BlackPower]

-snip-

 

[Andy.N]

I suspect they will have SPDY/3 working soon...

nginx 1.3.12 released today as well as openssl 1.0.1d
Updated both and still no spdy/3 yet

 

[digitalpoint]

Yeah... I installed Nginx 1.3.12 last night hoping it was going to fix the occasional worker segfault, but no such luck.

 

[Mike Edge]

Shawn, do you run DP on Nginx or Litespeed and if Nginx, why you went that route over Litespeed?

 

[digitalpoint]

We actually *just* migrated from Apache to Nginx a few weeks ago (at the same time we migrated to XenForo). Litespeed wasn't even in the running for evaluation for me because I wanted something with SPDY support.

I remember looking at Litespeed a few years ago and it wasn't bad... In fact for some things it was the best option. But it didn't do anything remarkably better, so the cost of the enterprise version was an issue also. Maybe now it does stuff much better, but for *me*, the fact that SPDY protocol support isn't an option at all makes Litespeed not an option at all for me.

 

[Mike Edge]

We actually *just* migrated from Apache to Nginx a few weeks ago (at the same time we migrated to XenForo). Litespeed wasn't even in the running for evaluation for me because I wanted something with SPDY support.

I remember looking at Litespeed a few years ago and it wasn't bad... In fact for some things it was the best option. But it didn't do anything remarkably better, so the cost of the enterprise version was an issue also. Maybe now it does stuff much better, but for *me*, the fact that SPDY protocol support isn't an option at all makes Litespeed not an option at all for me.

Thanks, I been considering Nginx as of late, the 8 core monthly license fee is something I can do without considering they been dropping the ball lately on new technology support like SPDY. I do like the built in intergration Litespeed offers with CloudLinux and CageFS right under the hood as I use it for shared forum hosting. But the 8 core monthly fee is making me start to consider other options.

 

[digitalpoint]

Yeah, when I looked at it some years ago, the Litespeed licensing was going to cost us somewhere around $30,000/year. It definitely didn't do anything $30,000 better even back then. But yeah... it seems to slowly have been falling behind Nginx technology-wise the last couple years as well, so...

Also, I can't say enough good about Nginx developers. Any issues we've had that we reported has always resulted in a patch within hours (literally) from Nginx developers and incorporated into the branch.