Hacker News Reader

Comment by sonnyblarney | Hacker News Reader

The 'web' is kind of for the commons, but HTTPS is just a few steps away from being 'easy'. The steps required are frankly just a little too weird and ugly.

Most people making web sites, even many devs, don't necessarily want to, or have the wherewithal to deal with SSL.

Setting up SSL on AWS recently was a monster pain the rear for our little nothing project site, granted a lot of that was AWS oriented.

It needs to be easier, if it were easy, everyone would be doing it.

View on HN

> many devs, don't [...] have the wherewithal to deal with SSL.

I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared web host (though in that case the web host should be setting up certs automatically for them), but what exactly is complicated about setting up certs for a dev? https://certbot.eff.org/ holds your hand through the entire ~30 second process. It's simpler than most other tasks a dev needs to do while setting up a website.

I use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think.

It is difficult if you want to understand the process, though no more so than, say, using Git IMO.

In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install

> It is difficult if you want to understand the process, though no more so than, say, using Git IMO.

Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)

I agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case

Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place.

The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.

This is a very good point, but as you say and the article states, the lack of warnings for this is changing.

There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).

certbot has failed continually on my DO instance. It cannot update my cert on cron. I have to manually update my cert when I remember to do so. In fact, I had forgotten to do this for the last several months, so my site gets to display a nice scary warning for anyone who might venture forth and try https. I've searched how to fix it and nothing comes up. The site is static html and I've considered just removing https.

What are the contents of your crontab? Anything in the certbot logs?

What server software are you running?

>but what exactly is complicated about setting up certs for a dev?

Seeing as how he mentioned AWS, it's a bit more complicated if you have a cluster of servers that are automatically managed. You have to set up a reverse proxy and integrate that into your cloud provider's workflow.

> what exactly is complicated about setting up certs for a dev?

it may not be complicated but you cannot beat doing nothing.

With certbot, it really is trivial for anything that's not using some very unusual setup. Shared hosting systems like CPanel have also added support.

Our biggest problem with the transition was mixed content issues with hardcoded HTTP URLs hidden away on long-forgotten pages.

On AWS can't you just use ACM which is supposed to be pretty painless

https://aws.amazon.com/blogs/aws/new-aws-certificate-manager...

Doesn't seem that bad

ACM combined with the various other services you need, especially Route53 or whatever, plus their byzantine new networking and security rules ... means you need to read a few sections of several different manuals to just do basic things.

AWS has become very complex over the last few years - there was a period where you didn't need admins. Now it seems you do again, just cloud admins, not local machine admins.

But all the rest is just the normal stuff; I mean TLS isn't adding any further complexity there.

> many devs, don't [...] have the wherewithal to deal with SSL.

Those devs need to be shamed and taught a lesson.

>many train operators don't [...] have the wherewithal to read the safety manual

>many police officers don't [...] have the wherewithal to attend gun safety classes

>many senators don't [...] have the wherewithal to listen to their constituents

Reply on news.ycombinator.com