[RESOLVED] URGENT : SITE SECURITY INVALID

[Jamiet99uk]

I tried to post this in the bug forum but it is not working (also a bug?)

Whenever I access the site I get a warning from my browser (both Samsung internet on my phone, and Chrome) that Webdiplomacy.net has an expired, invalid security certificate and the site is unsafe.

Is this being addressed? Admins?

[Tom Bombadil]

Strange. I am getting no such errors.

Is your computer clock correct? I know that sometimes produces that error if somehow the date is wrong.

[Claesar]

You're not the only one. As soon as an admin is available, we'll be on top of this.

[Octavious]

I get it too. I didn't notice at first as I never bothered to switch from http to https on my phone's browser, but now that I've done so it ain't happy.

[flash2015]

I didn't know we had https. It looks like the cert expired today:

www.webdiplomacy.net uses an invalid security certificate. The certificate expired on May 25, 2018, 4:15 AM. The current time is May 25, 2018, 9:14 AM.

[ssorenn]

I got it too. I cleared all browser history and retyped site into browser to get back

[kestasjk-testing]

Sorry folks, this should now be sorted

[Tom Bombadil]

Multiaccounter. MODS. BAN HIM.

[bo_sox48]

Lol woops

Thanks kestas

[Jamiet99uk]

Great thanks. It does appear fixed.

[flash2015]

When was SSL added? I think I asked about this a couple of months ago and was told it was not a priority. Not complaining though. Thanks very much for adding it!

[jmo1121109]

It was not a priority but kestas got bored and then we had it lol

Kestas also provided a way for myself and other admins to fix this issue if it comes up again so thanks for that!

[flash2015]

Do you plan to add the redirect in apache config (or equivalent in nginx if you are using that) to automatically redirect http to https...or are you letting these changes soak for a while first?

[ghug]

I might take a look at that this weekend if I get some time. We also need to redirect www and non-www to the same place at some point.

[jmo1121109]

I might take a look at that this weekend if I get some time. We also need to redirect www and non-www to the same place at some point.

There's a github issue to correct the cookie so that it works for both www and non www, it's technically a bug that it doesn't.

[ghug]

It's weird that they don't just redirect though. Look at what happens on most sites when you type the URL with/without the www.

[JECE]

You can combine user's cookies from two different websites? How would that work if the browser thinks that www and non-www are two different websites?

[JECE]

flash2015:

When was SSL added? I think I asked about this a couple of months ago and was told it was not a priority.

It was in February. See the announcement thread:
https://webdiplomacy.net/contrib/phpBB3 ... ?f=5&t=325

This seems to be the discussion that sparked kestasjk's interest:
https://webdiplomacy.net/contrib/phpBB3 ... f=17&t=106

[jmo1121109]

You can combine user's cookies from two different websites? How would that work if the browser thinks that www and non-www are two different websites?

Something like this: https://stackoverflow.com/questions/184 ... and-domain