Who is moving to https?
 

Anyone making the jump? Google chrome is starting to become an issue for sites not using an ssl as is Apple. I found out a couple days ago my IOS app will not be working as of January 1 unless I use https..

Does anyone have any strategy or plans for switching?

I have been using SSL now for a little over two years. I remember during the transition that the site's traffic plummeted. http and https are not looked at as the same url and link juice was deluded even with a 301 redirect. All those back links to my site lost a lot of weight. They were pointing to http and not https, and when I redirected the http to https through htaccess the site lost ranking. Lastly, it took some time for Google to reindex the site and update the site's urls.

Just a heads up, be patient because it will get worse before it gets better. If you're working on SEO, save your money until after you make the transition, because building up the http address is a waste in the long run.

One of the sites I help admin is beginning to talk about it. :)

I've been using it for a long time now with thanks to https://letsencrypt.org/ for free SSL certificates.

Yeah, that is what I am afraid of and why I have put this off for a long time.

--------------- Added 29 Nov 2016 at 19:37 ---------------

Thanks for that link!

I think mine cost me about $15 a year or something. I do have an ssl set up. I just do not have it for the entire domain.

Best thing is, you can setup automated cronjobs that renews the LetsEncrypt SSL certificate so you never have to worry about renewing them manually.

Apache: https://www.digitalocean.com/communi...n-ubuntu-16-04
nginx: https://www.digitalocean.com/communi...p-auto-renewal
IIS: https://github.com/ebekker/ACMESharp

Or use https://certbot.eff.org/

I use Lets Encrypt also, on a VB friendly host, GlowHost. I started my site from scratch with SSL, so i managed to avoid the worry of lost back links etc...

Best way to go using SSL in my opinion. People just do not trust unsecured sites like they used to.

I added https capability to my forum for anyone who wanted to use it, but its not the default.

The same applies to vb.org, it will work here if you want, but its not the default.

We actually switched vb.com to use it as the default yesterday, since its needed for the IOS mobile app (mandatory soon).

I used https://www.sslforfree.com/ which uses https://letsencrypt.org/ for generating the certificates. It's easy to use. I just have no time to install the certificate on the server yet and the cron jobs to auto-renew.

Yep, that is exactly why I have to switch as well..

It would be interesting to see how switching impacts seo and traffic to Vbulletin.com.

--------------- Added [DATE]1480626162[/DATE] at [TIME]1480626162[/TIME] ---------------

I have been working on this and it turned out to be more complicated than I expected. Certain things are not functioning in the admincp I suppose from being blocked by browsers due to not being secure..

First though I have these 3 items I have not been able to find or I found and changed and they may be cached.
https://www.whynopadlock.com/check.php
I also am trying to get my htaccess to redirect both non www and www to https://

Appreciate the help,
Rich

Try this my Man ....

I also encountered problems in the AdminCP with HTTPS and Cloudflare. This is what I had to change:

/admincp/index.php look around line 495, and replace the $mainframe variable with

Thanks brother,

I tried that one earlier and I could not get on. I have to look at the rest of my htaccess.

I have decided to revert my main url's back to http for now.. Too many issues and some of them may be from Cloudflare. Thought I had this almost done but Chrome was giving me major issues.

As of right now my ads are using https as are other components though the main urls are still http.

PITA..

Thanks for the assistance bro

--------------- Added [DATE]1480630464[/DATE] at [TIME]1480630464[/TIME] ---------------

I just posted before I saw this. Let me take a look and maybe this is what I need. :)

Thanks

--------------- Added [DATE]1480630717[/DATE] at [TIME]1480630717[/TIME] ---------------

How did you have the Crypto page set on Cloudflare Dave?

Default settings as far as I know: flexible SSL, HSTS on, origin pulls off, opportunistic encryption on, TLS 1.3 on, automatic HTTPS rewrites on.

Thanks, I will give this another go in a few minutes. :)

Any idea as to what was messing up my htaccess redirects? I tried Cheech's above and I had this one as well:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} ^www\.(.*)
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

neither of these worked and gave me redirect errors..

Thanks again guys,
Rich

Ah yeah ! I had cloudflare too and it didn't work with the https ... they do say it has problems with it for some reason ... sorry my Man ...

That's ok brother, Thanks! :up:

--------------- Added [DATE]1480635993[/DATE] at [TIME]1480635993[/TIME] ---------------

I like Cloudflare but the plan I have is currently $20 The next one up is $200. :eek: I think that is the plan I need to use my own cert that I already have..I think my issue is that I need to use their cert.

Yeah I think so too ... that is what I remember from talking with hostgator about it all ...

I've used without issue in the past :

Then I just created a a page rule On cloudflare and disabled performance on the admincp and had no issues.

Looks like they will get me for another $5 per month just to use a decent cert from them.. I think that will do the trick though.

Will still need to figure out my htaccess but that should do it hopefully..

--------------- Added [DATE]1480636366[/DATE] at [TIME]1480636366[/TIME] ---------------

Thanks, I will try that htaccess

I already have everything bypassed for admincp. :)

--------------- Added [DATE]1480636898[/DATE] at [TIME]1480636898[/TIME] ---------------

I cannot understand why everything is messed up in Chrome.. looks like my entire theme is screwed up.

Looks OK to me.

Ok, I fixed that.. just had to add the full url to those images for the theme.

I just need to figure out my htaccess next and done. :)

I hate chrome dude ... I stay with firefox exclusively ...

I usually do but lately firefox has been sluggish and laggy mostly due to my speeddials and the sheer amount of tabs I have open at any one time.

Chrome seems to handle it ok but it is not always so friendly.

I have actually tried the latest IE and it is pretty quick but it doesn't have the tools I need, webdeveloper tool bar, Firebug, etc..

Anyways I use Firefox mostly still though my sites have to be user friendly to everyone.

This is my .htaccess:

Regarding Browsers, I now use Brave. Ex Mozilla CEO Is Back

For a direct link to Brave: https://brave.com/

I haven't any issue now with Cloudflare, though I did have to create a pagerule for the admincp. Rocket Loader is off for pages that have the Ckeditor, but overall Cloudflare has increased performance and lowered my page load time by several seconds. My load times are consistently under two seconds.

Enjoy,
Shim

Ok, I got a working solution. I did this myself and I am not very skilled at htaccess so please let me know if this is ok:

--------------- Added [DATE]1480654997[/DATE] at [TIME]1480654997[/TIME] ---------------

The solution I found that works better than htaccess is to use page rules in cloudflare. The only issue is that browsers will still have issues with mixed content such as images from third party sites not using https..

I have been using that import plug in for years so hopefully we will not have an issue with this. The plug in has a url replace setting so just put in your https://yoursite.XXX

--------------- Added [DATE]1480656801[/DATE] at [TIME]1480656801[/TIME] ---------------

Hmmmmm

I have everything set I believe but I am having issues now with both browsers in the admincpanel.

I cannot rebuild the search table because it will not load the next page. This is javascript..

When updating settings I do not ever get to the new page once completed.

I did update some of the urls for jquery, etc to include https


##Dave I did incorporate your change but it has helped this issue..

--------------- Added [DATE]1480658962[/DATE] at [TIME]1480658962[/TIME] ---------------

When I use this I get:
when saving admincp options..

Everything seems to be working fine except for the admincp.. I can see that the the url that pushes to the next page as in the image below are not https:// for some reason..

The error Seems to be caused by a plugin because it happens in the validate_setting_value function.

This is the htaccess I ended up using. This redirects everything to https://

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I am still having some issues inside the admincp.

I cannot use the user search now. In firefox it will not search at all and in Chrome the section where the search is shows up blank once I trigger a search.

Also, if I edit a forum it never finishes and redirects back. Same thing when I edit an option in the settings. Then if I look at the link below where it says the following:

The change to the PHP file I supplied a couple of posts ago did not fix that? I had the same issue and changing that fixed it for me.

Thanks Dave but no, no change with that. I am not getting an error any more but it is not fixing the issue.

RICHIE, you finally resolve this issue? i have the same problem.

i made a whm/cpanel module for lets encrypt which handles everything for you. just select the domain/subdomain you want to install it on and it handles everything else...

attached a few screens for you to look at....

I switched a long time ago because of this :D makes it so easy why wouldn't you :D

I never did resolve the issue but my work around is to use firefox, click on the yellow triangle warning in the url box and click disable security.. I do this in the admincp only..

--------------- Added [DATE]1482002174[/DATE] at [TIME]1482002174[/TIME] ---------------

I have Plesk. :)

Internal links still need to be changed, settings, etc. Adding the certificate itself is really easy. I use Cloudflare and their cert so that aspect is even easier.

I think there are still issues with certain areas of Vbulletin itself and some plug ins..

Thanks through..would use your plug for sure if I had cpanel.. :up:

Those getting mixed content warnings in the admincp, please make the file changes here:
http://www.vbulletin.com/forum/node/4355527

These changes will work for either vB3 or vB4 (not needed in vB5).
They are applied by default in 3.8.11 and 4.2.5.

I don't have those changes at all and I don't get mixed content warnings in the admincp and it always displays the greed padlock ....just saying ...

Same here... I also use an image importer to fix mixed content warnings in the forums/CMS/Blog etc.. So far I am keeping everything secure with no mixed content warnings by doing nothing other than installing the SSL and adding the image importer.

I actually made the changes to the admincp/index.php and I still have the issues with mixed content.

In addition when I click on those processing links with in the admincp they still show urls that do not have https://..

What version of Vbulletin do you guys have?

I'm using 4.2.3. Not sure how much help it will be. I hope you get it sorted out Richie