TST is Converting to HTTPS

[iacas]

Starting next Tuesday, March 22, we'll be taking a multi-step and thus multi-day (possibly multi-week) move toward switching The Sand Trap from being transmitted over HTTP to being transmitted over HTTPS.

At this point, there's nothing to worry about with just being HTTP - any of the transactions you conduct (like to buy a Supporter membership from our store) are handled over HTTPS - and the only data transmitted over HTTP is your login information. This will be some of the first areas we adjust.

Please use this thread to report anything like broken images or anything else that seems out of place. Any errors about an insecure page, an out-of-date certificate, etc. belong here too.

Thank you.

[iacas]

The first few steps are done. Logins are now done securely.

[iacas]

We're doing a little thing right now where all http:// requests are redirected/rewritten at the header level with HTTPS.

If that works well, we'll enable the base_url config file thing to https://.

[Patch]

I am getting "unsafe" warning that TST's certificate can't be verified. That hackers could get into my account. This is showing up on my phone, and laptop. Anyone else seeing this?

[jsgolfer]

6 hours ago, Patch said:

I am getting "unsafe" warning that TST's certificate can't be verified. That hackers could get into my account. This is showing up on my phone, and laptop. Anyone else seeing this?

I have not received that warning. 

[saevel25]

I believe this should have been posted over here,

TST to HTTPS

 

 

[saevel25]

I get a warning box from internet explorer asking of if I want to show all content.

I click the "Show all Content" and the page reloads but nothing seems to be added or blocked. It's a tad strange. Besides that I haven't received any issues with the site otherwise yet.

 

[iacas]

7 hours ago, Patch said:

I am getting "unsafe" warning that TST's certificate can't be verified. That hackers could get into my account. This is showing up on my phone, and laptop. Anyone else seeing this?

What version?

13 minutes ago, saevel25 said:

I get a warning box from internet explorer asking of if I want to show all content.

I click the "Show all Content" and the page reloads but nothing seems to be added or blocked. It's a tad strange. Besides that I haven't received any issues with the site otherwise yet.

What version?

BTW as a general rule, if one thing (say, a JavaScript file or an image)  isn't served over HTTPS, the page may throw a warning depending on your browser, version, and settings.

All said, the site is now more secure than it was yesterday. 99.9% of things are served HTTPS now.

[Ernest Jones]

Huh?

[saevel25]

17 minutes ago, iacas said:

What version?

 IE 10.0.9

I never had any warnings show up on Chrome at my home computer.

[iacas]

Just now, saevel25 said:

 IE 10.0.9

I never had any warnings show up on Chrome at my home computer.

We just changed some things last night. At… 9pm or so?

Thanks.

Again, TST is totally "safe." You're not posting private financial information or anything like that anyway. We may need to update to a different (more widely recognized?) certificate, but more than likely it's that we have to simply find every last resource that's still coming to you via HTTP instead of HTTPS.

It's not as simple as looking at the code, either, because we employ a server trick to send files via HTTPS even when the code asks for HTTP, like our favicons (we're still looking to change those links out, too, though).

[Club Rat]

Everything seems normal, I've log in using Edge and Chrome.

Chrome shows the Lock at https: and had a popup indicating a request to show notifications with the option to allow or block.

Edge also show the Lock which indicates the website identification - using Comoro Secure identifying the site. The connection to the server is encrypted.

8 hours ago, Patch said:

I am getting "unsafe" warning that TST's certificate can't be verified

I think "certificates" may need to be renewed as the site is now basically using the HTTPS address.

Try signing out and log on, a new certificate should then be issued.

[pumaAttack]

Some images are not hosted via HTTPS:

 

Causing them to not load.

Edited March 31, 2016 by pumaAttack

[iacas]

5 hours ago, Club Rat said:

Everything seems normal, I've log in using Edge and Chrome.

For people with up-to-date browsers, that is about how it works. Really smoothly and well.

5 hours ago, Club Rat said:

I think "certificates" may need to be renewed as the site is now basically using the HTTPS address.

No, the certificates are a few days old and are good for three years. Our issuing agency may not be in every list, so we may need to re-buy new ones, which we'll do if we must, but that's unlikely and these should work just fine. They're just being used mostly to encrypt traffic.

5 hours ago, Club Rat said:

Try signing out and log on, a new certificate should then be issued.

Not quite how it works, but signing out, emptying your cache and cookies, and signing back in are never a bad idea.

12 minutes ago, pumaAttack said:

Some images are not hosted via HTTPS:

Causing them to not load.

I don't know what images you're using, but when I type : nike : or : titleist : (without the spaces) they work just fine:

There's "titleist.png" being loaded over HTTPS.

On this page, right now, there are only a few things loaded via HTTP: c2_beer.gif and "taylormade.png". Both are probably in a signature.

(Note:  in @Patch's signature has been fixed, and "taylormade.png" sorted itself out:

(And that image, which is not uploaded but which is embedded, will cache on the local server and be served via HTTPS too!)

[pumaAttack]

26 minutes ago, iacas said:

 

I don't know what images you're using, but when I type : nike : or : titleist : (without the spaces) they work just fine:

There's "titleist.png" being loaded over HTTPS.

On this page, right now, there are only a few things loaded via HTTP: c2_beer.gif and "taylormade.png". Both are probably in a signature.

 

I'm using the same signature icons I have used for years.  I will go update those in my profile. Thanks!

[iacas]

Just now, pumaAttack said:

I'm using the same signature icons I have used for years.  I will go update those in my profile. Thanks!

I already did. You were using them with an IP address in the URL.

[pumaAttack]

1 minute ago, iacas said:

I already did. You were using them with an IP address in the URL.

Thanks!  

I think I got them from the old emoji list.  

[onthehunt526]

It's throwing up a "This page is unsafe" on Android Lollipop... It's saying that it's my OS blocking it.