Handle https:// requests

[MaStr]

Currently not supported.
Can we support it somehow?

Possible solutions:

1. enable in lighttpd
2. create deamon redirecting

What happens with certifacates and so on?
We have to discuss this.

http://forum.daviddarts.com/read.php?2,5986,6864#msg-6864

[terrorbyte]

We definitely can support https (I had it working on nginx) I think we should talk more about the ability for this to actually be useful. For example it won't add much security to the default non-internet attached devices as a man in the middle could still pretty easily pick out who was sharing... This might not be to useful but it could be an interesting proof of concept.

[joschi70]

I've tried this on Android. As expected, the problem is the certificate.
Browsers will complain about the incorrect certificate (which normally is a good thing). Some browsers allow the user to visit the site anyway, but in case of the mobile version of Chrome you can't event enter the site.
So this might be hard to do, if possible at all.

[terrorbyte]

Yes that is the expected behaviour of a self signed certificate. If you were to get a signed certificate it would probably work fine. I think that since the switch to lighttpd we can say we "officially" support https and thus this can be closed.

[MaStr]

The valid signed certificate won't help you much, because the URL won't match.
The question is: does the browser a SSL check before or after working on a redirect request via http code?!

Sure we have lighttpd running but still not SSL enabled.
So task is still open :/

Cale Black notifications@github.com schrieb:

Yes that is the expected behaviour of a self signed certificate. If you
were to get a signed certificate it would probably work fine. I think
that since the switch to lighttpd we can say we "officially" support
https and thus this can be closed.

---

Reply to this email directly or view it on GitHub:
#37 (comment)

Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.

[joschi70]

The initial connection initiated by the browser is already a SSL connection.
So you need a certificate, there is no way around that.
And because there is no valid certificate for the requested URL the browser issues a warning.

[FriedZombie]

The ssl security is done before any other interaction with the server (including redirects). Also if a bigger/known website has an invalid ssl cert it will trip up some virus scanners as well.

https://www.identrustssl.com/images/learn_ssl_diagram.gif

[MaStr]

I think over all this are enough reasons for not following this request anymore.