Forcing vBulletin to use HTTPS

[IndigoSociety]

How would I convert my forum to run on HTTPS instead of HTTP?

Does vBulletin support this mainly out of the box? I can't find anything on this besides a "hacky" vbulletin.com forum post.

[private_ale]

It supports it. I would personally wait until the release of 4.1.10 as it fixes a inline-moderation bug relating to HTTPS. The only really vB-specific thing to change is the relevant values in the Site Name / URL / Contact Details section of the ACP to use "https://" instead of "http://".

Since you've omitted a good chunk of information (webserver configuration & control panel, if any) no one is going to be a able to help much.. So you'll have to contact your host about that. You will need a private IP address and a valid certificate, though.

It's not difficult.

[techtech3d]

This is a great question.

I've changed the Site links to https.

However the login box does not pop up in Firefox, Chrome, and IE as they all believe it's a security concern of http mixing with https.

In my .htaccess file I've forced all to https but no luck. I have PHP 5.4 running with Vbulltein 4.2.1 on a Linux setup.

Any ideas? (Clean browsers were used on various machines.)

[squidsk]

You likely have either a self-signed SSL certificate or a certificate that is not issued by a signing authority that is recognized by those web browsers, which means that every user will at least once be forced to see the message and click to continue on anyways.

[techtech3d]

@squidsk

Wanted to update. The HTTPS site was pulling an HTTP located ajax script.

Thus the browsers went crazy as HTTP and HTTPS were mixed for the users.

Thanks for the help!

[tbworld]

Originally Posted by techtech3d

I have PHP 5.4 running with Vbulltein 4.2.1 on a Linux setup.

Just a reminder:

vb4.2.1 <--> php 5.3
vb4.2.2 <--> php 5.3, php 5.4

Unless you have personally modified your vb4.2.1 code you will run into some problems.

[Dave]

You also have to keep in mind that if any of your users include any images or external resources in their post, it will "break" the HTTPS since most of the time those external resources are being loaded over HTTP instead of HTTPS.

[CAG CheechDogg]

Originally Posted by Dave

You also have to keep in mind that if any of your users include any images or external resources in their post, it will "break" the HTTPS since most of the time those external resources are being loaded over HTTP instead of HTTPS.

That is not true with images, with scripts it is, but images will still load fine if they are served from http instead of https ...

[Dave]

Originally Posted by CAG CheechDogg

That is not true with images, with scripts it is, but images will still load fine if they are served from http instead of https ...

Of course it will load fine, but that doesn't mean your HTTPS connection is secure if you load HTTP images of an external server.

[CAG CheechDogg]

From what I understand, only those elements which are not on https are not encrypted, everything else that is behind https is .. unless you have actual documentation that what you are saying is true the purpose of having "your" content or elements behind https is for just that, to encrypt that which is behind https...