{bjørn:johansen}

Tag

https

7 posts Feed
  1. 2016

    The future of Certificate Authorities

    With the advent of the fully automated and free of cost certificate authorities Let’s Encrypt and StartCom there is no doubt that the future of CAs are changing.
  2. 2016

    Let’s Encrypt for Nginx

    Let’s install an SSL-certificate from Let’s Encrypt for Nginx.
  3. 2015

    Redirect all HTTP requests to HTTPS with Nginx

    All login credentials transferred over plain HTTP can easily be sniffed by an MITM attacker, but is is not enough to encrypt the login forms. If you are visiting plain HTTP pages while logged in, your session can be hijacked, and not even [two-factor authentication](https://www.bjornjohansen.com/two-factor-authentication-for-wordpress) will protect you. To protect all info sent between your visitors – which includes you – and your web server, we will redirect all requests that are coming over plain HTTP to the HTTPS equivalent.
  4. 2015

    WordPress behind Big-IP

    To be honest, I don’t exactly know too much about Big-IP, but I’ve come across someone who use it. They terminate HTTPS in Big-IP and WordPress runs on plain HTTP on port 80 on the backend nodes. By default, this makes WordPress confused, so you can’t login to the WordPress dashboard.
  5. 2015

    HTTP Public Key Pinning (HPKP)

    [Using HTTPS](https://www.bjornjohansen.com/securing-nginx-ssl) helps preventing someone from snooping your username/password or hijacking your sessions. [Using HSTS](https://www.bjornjohansen.com/optimizing-https-nginx) makes sure the connection stays on HTTPS, even if a MITM tries to redirect you to the plain HTTP version of a web site. But it is easier than you might think for a MITM to use a rogue certificate, making you believe everything is fine. HTTP Public Key Pinning (HPKP) helps the browser check that everything actually is fine.
  6. 2014

    Optimizing HTTPS on Nginx

    Now that you have secured [Nginx with HTTPS](https://www.bjornjohansen.com/securing-nginx-ssl) and [enabled SPDY](https://www.bjornjohansen.com/enabling-spdy-nginx) [enabled HTTP/2](https://www.bjornjohansen.com/enable-http2-on-nginx), it's time to improve both the security and the performance of the server.
  7. 2013

    Securing Nginx with HTTPS

    ![SSL](https://www.bjornjohansen.com/content/uploads/2013/08/origin_4146023669-150x150.jpg)Adding a certificate and using the HTTPS protocol is a good improvement to the security in the communication between the browser and the server, and should be in place on all sites that have a user login. Contrary to what many (older) guides say, it doesn't add much load on your server and is fairy easy and cheap to set up right.