In early January I enabled HTTPS/SSL on the discussion forums with the primary goal of securing user credentials that were being used to log into the forums. Almost twelve months later I’ve found some free time to migrate my blog to HTTPS/SSL as well. The goal is essentially the same, however, this change is more to protect my credentials as I’m really the only user that logs into WordPress. That said there’s more to secure than just the user credentials. Security is becoming a big and bigger topic as ISPs have been taking more and more liberties with customer traffic. While some ISPs have been data mining and profiling their customer traffic other ISP are actively inserting third parties cookies and headers into the datastream. You only need to search Google for a few minutes to find some blatant examples. It’s one of the reasons I’ve started using private VPN services, using HTTPS/SSL over an IPSec VPN I should say.
In addition, Google has been using HTTP/HTTPS signals in their ranking for quite a few months now. Not sure if that will have any impact on my little blog but I’m happy to try and push that percentage of sites using HTTPS/SSL just a little higher.
I purchased a wildcard SSL certificate from RapidSSL that covers *.michaelfmcnamara.com. I have multiple servers and virtual hosts so it only made sense to purchase a wildcard certificate instead of purchasing multiple individual certificates.
The installation was pretty simple, I did need to bundle all the certificates including the root GeoTrust Global CA, the intermediate RapidSSL SHA265 CA – G3 and then my certificate into the certificate file so the browser was presented the proper SSL chaining. I changed the WordPress Address and Site Address URLs from within WordPress and then I setup a redirect from Nginx;
server { listen [::]:80; server_name blog.michaelfmcnamara.com mirror.michaelfmcnamara.com; return 301 https://$server_name$request_uri; }
I also had to make a few small changes to the Google Adsense scripts.
Any Issues?
Yes, there will be a few issues… Internet Explorer 8 for Windows XP doesn’t support SNI (Server Name Indicator) so that browser won’t be able to connect now that I’ve enabled two SSL enabled sites on the same IP address using two different certificates in Nginx. If you are still using Internet Explorer 8 on Windows XP you should really consider migrating off Windows XP.
Are you going to enable HTTPS/SSL on your blog or website?
Cheers!
Update: December 30, 2015 – I had issues uploading images via WordPress after turning on the HTTP redirect. I was getting the error “An error occurred in the upload. Please try again later.” when I tried to upload an image via HTTPS/SSL. I had to go into wp-config.php and add the following, “define(‘FORCE_SSL_ADMIN’, true);” which appears to have resolved the problem.