Last November, The New York Times challenged news sites to fully support HTTPS in 2015. What does it mean to meet that challenge? This session will discuss the problems we encountered moving to HTTPS (and how we solved them). We'll then give you hands-on help with anything you need: server configuration, certificates, mixed-content warnings, CDNs — even ads, analytics and A/B tests. Handout: https://docs.google.com/document/d/1EJKAoa4Hxc4AyH0znuA_AAplcNeNejEhATFptFX-OME/edit#

1. Delivering the news
over HTTPS

2. A Call to Action
If you run a news site, or any site at all, we’d like
to issue a friendly challenge to you. Make a
commitment to have your site fully on HTTPS by
the end of 2015 and pledge your support with
the hashtag #https2015.
—Eitan Konigsburg, Rajiv Pant and Elena Kvochko
“Embracing HTTPS”
November 13, 2014

3. Paul Schreiber
@paulschreiber
Mike Tigas
@mtigas

4. quick look

5. HTTP

6. HTTPS

10. why?

16. config

23. “regular”

24. SAN

25. wildcard

26. SNI

27. sha1 vs sha2

28. Extended Validation (EV)

31. $
sslmate
mkconfig

32. https://mozilla.github.io/
server-­‐side-­‐tls/
ssl-­‐config-­‐generator/

33. HTTPS enabled
HTTPS default
HSTS
HSTS preload

34. content

37. content

38. content
😕

39. comments

40. ads

41. social

42. analytics

43. CDNs

44. fonts

45. cost

47. performance

48. 2008 HTTPS is slow

49. 2008 HTTPS is slow
2015 HTTPS is fast

50. problems

51. problems

52. solved
problems

53. NoHTTPS?
ask
nicely.

54. NoHTTPS?
SoundCite
placehold.it

55. mixedcontent

56. mixedcontent
$
mixed-­‐content-­‐scan

57. mixedcontent
Content-­‐Security-­‐Policy:
upgrade-­‐insecure-­‐requests

58. mixedcontent Content-­‐Security-­‐Policy-­‐
Report-­‐Only:
default-­‐src
https:
data:
'self'
'unsafe-­‐inline'
'unsafe-­‐
eval';
report-­‐uri:
https://myserver.com/log-­‐
tool/

59. mixedcontent

60. mixedcontent
Akamai
http://hostname.com
→
https://a248.e.akamai.net/f/
12/621/60d/hostname.com

61. Many graphics from The Noun Project
Calendar by Mani Amini. Money by Nick Levesque.
Shielf by Wayne Thayer. SEO by Azis. Gauge by
Dalpat Prajapati. Scribble by Michael Chanover. Lock
with keyhole by Brennan Novak. Warning by Icomatic.
Error by Anas Ramadan. Network by Stephen Boak.
Server by Yazmin Alanis. Hat based on work by Blake
Kimmel.