-
Let’s Encrypt + Nginx: Three Months Into Beta
Nginx Plugin During Early Beta When Let’s Encrypt started their closed beta, their documentation warned that their Nginx plugin was experimental. Using it as the authenticator to obtain certificates seemed to work, but using it as the installer would almost certainly guarantee that your Nginx configuration would become a jumbled mess. But that automated installation […]
-
Let’s Encrypt SSL Certificates and Nginx
HTTPS and Encryption by Default Encryption by default has become the new standard for web applications and many of the world’s top busiest sites have already made the switch to serving content via HTTPS. Google is no stranger to encryption, having made HTTPS the default for many of their apps long before it was cool,…
-
Nginx redirect and SSL configuration example
Over the past few months I’ve been working with WordPress sites a surprising amount. During this same time, I decided to switch all of my sites over to HTTPS exclusively. The switch was relatively painless, especially since free SSL certificate are now available. I started with the HTML 5 Boilerplate team’s Nginx configuration snippets maintained…
-
Create a self-signed SSL certificate for Nginx
If your application has any sort of login page or transmits sensitive information, it’s wise to make those sections accessible only via HTTPS. Even if your site has no sensitive information, it’s worth considering using HTTPS as Google now considers it a ranking signal. For any pages a general user will access, you’ll want to…
-
Obtain and install a free SSL certificate on Nginx
Until the past year I never really bothered to put my projects behind SSL. It always seemed like more of a hassle than it was worth, and I didn’t like the idea of paying $50+ for a properly-signed SSL certificate when none of my projects were commercial or transmitting sensitive information. As my projects become more elaborate,…
-
Poodlebleed exploits SSL 3.0
Despite being 15 years old, and theoretically replaced by TLS, SSL 3.0 is still in widespread use. As luck would have it, yesterday Google researchers revealed a vulnerability in 3.0 which allows for the decryption of secure connections. Poodlebleed is a vulnerability in the design of SSL version 3.0. Poodle is actually an acronym for Padding Oracle…