Enable HTTPS for main site #324

mattharris · 2019-09-02T08:45:48Z

Currently, the main jmri.org site is only accessible via HTTP.

More and more browsers flag this as insecure, leading to the potential of confusion for those browsing our site.

Additionally, not serving content over HTTPS has a negative impact on SEO ranking.

This issue is to act as a reminder for the tasks needed to implement this

mattharris · 2019-09-04T20:46:25Z

Install certbot on server
Check crontab for renewal jobs
Get LetsEncrypt certificate for www.jmri.org and jmri.org
Redirect all HTTP traffic to HTTPS via Apache
Sort out mixed content on pages

mattharris · 2019-09-05T14:10:46Z

When running a crawl, found a problem href that seemed to cause an infinite loop - see JMRI/JMRI#7390

mattharris · 2019-09-10T16:33:04Z

Updated apache config to redirect all non-https requests to https.

Additionally, made https://www.jmri.org canonical.

mattharris · 2019-09-12T16:01:56Z

Based upon the jmriusers message https://groups.io/g/jmriusers/topic/34113103#163784 seems like the Check for updates functionality might be broken...

bobjacobsen · 2019-09-12T17:54:02Z

I get unexpected results trying to access the releaselist file with curl (wget seems fine):

% curl https://jmri.org/releaselist
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://www.jmri.org/releaselist">here</a>.</p>
<hr>
<address>Apache/2.4.18 (Ubuntu) Server at jmri.org Port 443</address>

% curl http://jmri.org/releaselist
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://www.jmri.org/releaselist">here</a>.</p>
<hr>
<address>Apache/2.4.18 (Ubuntu) Server at jmri.org Port 80</address>
</body></html>

but access as curl https://www.jmri.org/releaselist is OK. So perhaps the URL in the code needs to be changed to that?

bobjacobsen · 2019-09-12T17:56:01Z

Fixing it in the code is helpful, but fixing it so that old code can still check for updates would be good too. I didn't think of coding that Action to do a "if this goes wrong, you probably need to update" thing...

mattharris · 2019-09-12T18:45:55Z

Now fixed by using some rewrite rule magic ;-)

Added the following to the site config file

        # Redirect everything except `releaselist` in root
        RewriteEngine on
        RewriteCond %{REQUEST_URI} !/releaselist [NC]
        RewriteCond %{HTTPS} off
        RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI}

mattharris · 2019-09-12T19:06:08Z

@bobjacobsen can you double-check from your end the result from curl http://jmri.org/releaselist?

This is what I now get with the recently applied server config update:

$ curl http://jmri.org/releaselist
production:
 versions:
  4.16:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.16/JMRI.4.16+R6f9aced.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.16/JMRI.4.16+R6f9aced.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.16/JMRI.4.16+R6f9aced.exe"
  4.14:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.14/JMRI.4.14+Rd060e0b.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.14/JMRI.4.14+Rd060e0b.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.14/JMRI.4.14+Rd060e0b.exe"
  4.12:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.12/JMRI.4.12+Rb6a9bb1.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.12/JMRI.4.12+Rb6a9bb1.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.12/JMRI.4.12+Rb6a9bb1.exe"
test:
 versions:
  4.17.4:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.17.4/JMRI.4.17.4+Rbf0d1af.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.17.4/JMRI.4.17.4+Rbf0d1af.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.17.4/JMRI.4.17.4+Rbf0d1af.exe"
  4.17.3:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.17.3/JMRI.4.17.3+R12d2ded.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.17.3/JMRI.4.17.3+R12d2ded.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.17.3/JMRI.4.17.3+R12d2ded.exe"
  4.15.9:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.15.9/JMRI.4.15.9+Re0a9348.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.15.9/JMRI.4.15.9+Re0a9348.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.15.9/JMRI.4.15.9+Re0a9348.exe"

# This file contains information about the last few JMRI (https://jmri.org) releases.
# JMRI is distributed under license. More information is at https://jmri.org/Copyright.html
#
# Note to maintainers:  The zero, one, two, three space indentations in this file are significant

And this is from curl https://www.jmri.org/releaselist:

$ curl https://www.jmri.org/releaselist
production:
 versions:
  4.16:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.16/JMRI.4.16+R6f9aced.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.16/JMRI.4.16+R6f9aced.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.16/JMRI.4.16+R6f9aced.exe"
  4.14:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.14/JMRI.4.14+Rd060e0b.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.14/JMRI.4.14+Rd060e0b.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.14/JMRI.4.14+Rd060e0b.exe"
  4.12:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.12/JMRI.4.12+Rb6a9bb1.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.12/JMRI.4.12+Rb6a9bb1.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.12/JMRI.4.12+Rb6a9bb1.exe"
test:
 versions:
  4.17.4:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.17.4/JMRI.4.17.4+Rbf0d1af.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.17.4/JMRI.4.17.4+Rbf0d1af.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.17.4/JMRI.4.17.4+Rbf0d1af.exe"
  4.17.3:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.17.3/JMRI.4.17.3+R12d2ded.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.17.3/JMRI.4.17.3+R12d2ded.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.17.3/JMRI.4.17.3+R12d2ded.exe"
  4.15.9:
   tgz: "https://github.com/JMRI/JMRI/releases/download/v4.15.9/JMRI.4.15.9+Re0a9348.tgz"
   dmg: "https://github.com/JMRI/JMRI/releases/download/v4.15.9/JMRI.4.15.9+Re0a9348.dmg"
   exe: "https://github.com/JMRI/JMRI/releases/download/v4.15.9/JMRI.4.15.9+Re0a9348.exe"

# This file contains information about the last few JMRI (https://jmri.org) releases.
# JMRI is distributed under license. More information is at https://jmri.org/Copyright.html
#
# Note to maintainers:  The zero, one, two, three space indentations in this file are significant

So, we should be able to either:

leave things as-is
change to use the now canonical form

mattharris · 2019-09-12T19:21:51Z

Looks like the rewrite rule needs to also consider the problem-report.php file as well in jmri.jmrit.mailreport.ReportPanel

mattharris · 2019-09-12T19:27:19Z

Fixed that one now also

bobjacobsen · 2019-09-12T21:01:46Z

can you double-check from your end the result from curl http://jmri.org/releaselist?

Works! it’s getting the right file.

bobjacobsen · 2019-11-04T15:10:46Z

This all seems to be working really well now. @mattharris Thank you! Can we close this?

mattharris · 2019-11-04T17:10:32Z

There are still some mixed-content pages, but we can deal with these as-and-when we find them.

Plus it looks like the first automated certificate renewal has run successfully this morning:

So agree that this can be closed now.

mattharris self-assigned this Sep 2, 2019

mattharris mentioned this issue Sep 4, 2019

First pass at sorting mixed-content parts #325

Merged

This was referenced Sep 10, 2019

Absolute to relative URLs; sort more mixed-content #327

Merged

fix a 404 JMRI/JMRI#7410

Merged

This was referenced Sep 13, 2019

More mixed content fixes & redirect targets JMRI/JMRI#7417

Merged

More mixed content & 404 fixes #328

Merged

devel-bobm mentioned this issue Sep 19, 2019

Signaling System pages generated incorrectly #329

Closed

mattharris closed this as completed Nov 4, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable HTTPS for main site #324

Enable HTTPS for main site #324

mattharris commented Sep 2, 2019 •

edited

Loading

mattharris commented Sep 4, 2019 •

edited

Loading

mattharris commented Sep 5, 2019

mattharris commented Sep 10, 2019

mattharris commented Sep 12, 2019

bobjacobsen commented Sep 12, 2019

bobjacobsen commented Sep 12, 2019

mattharris commented Sep 12, 2019 •

edited

Loading

mattharris commented Sep 12, 2019

mattharris commented Sep 12, 2019

mattharris commented Sep 12, 2019

bobjacobsen commented Sep 12, 2019 via email

bobjacobsen commented Nov 4, 2019

mattharris commented Nov 4, 2019

Enable HTTPS for main site #324

Enable HTTPS for main site #324

Comments

mattharris commented Sep 2, 2019 • edited Loading

mattharris commented Sep 4, 2019 • edited Loading

mattharris commented Sep 5, 2019

mattharris commented Sep 10, 2019

mattharris commented Sep 12, 2019

bobjacobsen commented Sep 12, 2019

bobjacobsen commented Sep 12, 2019

mattharris commented Sep 12, 2019 • edited Loading

mattharris commented Sep 12, 2019

mattharris commented Sep 12, 2019

mattharris commented Sep 12, 2019

bobjacobsen commented Sep 12, 2019 via email

bobjacobsen commented Nov 4, 2019

mattharris commented Nov 4, 2019

mattharris commented Sep 2, 2019 •

edited

Loading

mattharris commented Sep 4, 2019 •

edited

Loading

mattharris commented Sep 12, 2019 •

edited

Loading