The Forums are now running as SSL - About the Forums

As you may have noticed, beginning a little while ago we switched the forums to running under SSL.

I am sure some things broke as a result (for instance we just fixed a problem with embedded youtube links).

Please use this thread to report issues and we'll fix them as soon as possible.

Quote

09-03-2017 , 12:25 PM

Loki

binary duo

Join Date: Nov 2015 Posts: 12,772

the ATF page reports that it is secure, this thread does not

confirmed that this behavior happens in other forums vs threads

edit

meaning that the link is still https, but it doesn't show the green lock in chrome. It does in firefox and edge.

Chrome says "Your connection to this site is not fully secure. Attackers might be able to see or modify images you're looking at". Opera also says this thread contains some insecure content

SSL Labs indicates that secure renegotiation is not enabled, which has its own CVE from 2009. They also griped about Forward Secrecy, which I've never heard of.

Last edited by Loki; 09-03-2017 at 12:35 PM.

Quote

09-03-2017 , 12:34 PM

Chuck Weinstock

Administrator

Join Date: Aug 2002 Posts: 666

Interesting. I am running chrome and I see "Secure" on every page I visit. I will continue to look into this.

Quote

09-03-2017 , 12:37 PM

Chuck Weinstock

Administrator

Join Date: Aug 2002 Posts: 666

Quote:

Originally Posted by Chuck Weinstock

Interesting. I am running chrome and I see "Secure" on every page I visit. I will continue to look into this.

We still need to put in the forced redirect for references to http://forumserver.twoplustwo.com

I am holding off a bit on this so that we don't change too much at once...but this may be the reason you see what you are seeing.

Quote

09-03-2017 , 01:39 PM

whosnext

Carpal \'Tunnel

Join Date: Mar 2009 Posts: 6,732

In case one more bit of confirmation has any value, I am seeing the same thing as Noodle posted above.

In Chrome I get the green "Secure" at the forum level, but whenever I click a thread to actually read any posts the green "Secure" goes away.

Quote

09-03-2017 , 02:04 PM

Loki

binary duo

Join Date: Nov 2015 Posts: 12,772

Opera gives you the option to load the insecure content, but it wasn't clear at all what was loaded when I clicked it. :shrug:

Quote

09-03-2017 , 02:50 PM

Chuck Weinstock

Administrator

Join Date: Aug 2002 Posts: 666

I believe all of you. I am awaiting one more change to complete before I try to track this further (later today). FWIW, when I go to the forums I see the secure indication in Chrome (and Safari). When I go to a particular forum (say this one) I also see the secure indication. And when I go to a thread (say this one) I also see the secure indication. So there is something different but I am not yet sure what.

Quote

09-03-2017 , 03:42 PM

Chuck Weinstock

Administrator

Join Date: Aug 2002 Posts: 666

I *may* have fixed the problem some of you have observed. Would one of you please let me know if the forums load properly now at the forum and thread level?

In the process I *may* have broken the Hand History Converter. I hope I haven't but I don't have a hand history to test it with.

Again, would one of you let me know if that is still working.

Thanks.

Quote

09-03-2017 , 03:55 PM

whosnext

Carpal \'Tunnel

Join Date: Mar 2009 Posts: 6,732

No, same as before.

Quote

09-03-2017 , 04:07 PM

#10

kioshk

Nixonian

Join Date: Oct 2006 Posts: 92,830

The TamperMonkey scripts that let me ignore mods aren't working right.

Quote

09-03-2017 , 05:05 PM

#11

Neil S

King of the sidebar

Join Date: Sep 2004 Posts: 19,675

You have to change the http to https. I just had to do the same.

Quote

09-03-2017 , 06:01 PM

#12

goofyballer

Carpal \'Tunnel

Join Date: Jun 2005 Posts: 70,719

Bug: the "view first unread" link at the top of the page links to http, not https, so it causes the browser to reload the page (it's on https but thinks it's going to http, even if you're already viewing the page with the first new post) rather than jump down to the right spot in the page.

Quote

09-03-2017 , 06:41 PM

#13

Loki

binary duo

Join Date: Nov 2015 Posts: 12,772

Since going to https, the YouTube and twitter quick reply icons that weren't showing before have started working again on iPad, so yay for that!

Quote

09-03-2017 , 07:04 PM

#14

gregorio

Carpal \'Tunnel

Join Date: Jan 2007 Posts: 39,313

That's why all those animate avatars I had blocked started showing up all the sudden.

Quote

09-03-2017 , 11:29 PM

#15

Bobo Fett

Carpe Diem

Join Date: May 2006 Posts: 56,895

Quote:

Originally Posted by Neil S

You have to change the http to https. I just had to do the same.

Thank you!! I had such a sad when your custom sidebar broke, but now it's all better. Amazing what a difference a single letter can make to your life.

Also experiencing the same thing others are with no secure symbol inside threads on Chrome.

Edit to add: I still has a sad, because the script is now working intermittently. I assume this is because the https implementation still has some bugs.

Quote

09-04-2017 , 07:55 AM

#16

kioshk

Nixonian

Join Date: Oct 2006 Posts: 92,830

Quote:

Originally Posted by Neil S

You have to change the http to https. I just had to do the same.

thanks! You're a lifesaver.

Quote

09-04-2017 , 02:56 PM

#17

Neil S

King of the sidebar

Join Date: Sep 2004 Posts: 19,675

Quote:

Originally Posted by Bobo Fett

Thank you!! I had such a sad when your custom sidebar broke, but now it's all better. Amazing what a difference a single letter can make to your life.

If it stops working you probably followed a link to a non-https page. That was happening to me Friday.

Quote

09-04-2017 , 08:33 PM

#18

Chuck Weinstock

Administrator

Join Date: Aug 2002 Posts: 666

As you've probably noticed the "Secure" symbol in the URL is there only part of the time as you browse the forums. It goes away occasionally for a number of reasons that we are busy tracking down and eliminating one-by-one. Some we will never be able to easily eliminate.

As an example, if a post on the page being viewed has an embedded image that is being served via an http:// tag instead of a https:// tag the Secure symbol will not appear.

Please be patient as we work our way through this transition.

Quote

09-04-2017 , 09:53 PM

#19

gregorio

Carpal \'Tunnel

Join Date: Jan 2007 Posts: 39,313

Will this plus this keep the certificate working with non-https images?

Quote

09-05-2017 , 02:48 AM

#20

_dave_

_Pooh_Bah_

Join Date: Feb 2005 Posts: 13,146

Quote:

Originally Posted by Chuck Weinstock

One of those reasons is the "tweet" icon for the editor is served over only http (when using 2+2 theme), this one: http://www.twoplustwo.com/images/tweet.jpg

Quote

09-05-2017 , 03:31 AM

#21

Bobo Fett

Carpe Diem

Join Date: May 2006 Posts: 56,895

Quote:

Originally Posted by Neil S

If it stops working you probably followed a link to a non-https page. That was happening to me Friday.

I don't think it was that consistent. However, I've now added another @include line so that both the http and https URLs are covered (previously I replaced it), and so far it seems to be working.

Quote

09-05-2017 , 04:49 AM

#22

frommagio

Pooh-Bah

Join Date: Jan 2005 Posts: 4,453

Probably nobody planned on testing this, but the legacy 2+2 application is having problems connecting: "Failed to connect to the forum, please check with the forum administrator if this problem persists." This tends to happen with authentication issues, e.g., every time we switch between standard time and daylight savings. Usually retrying a few times will establish a connection.

I started seeing this issue a few days ago, but the retries succeeded. But now, it's just failing to connect no matter how many times I retry.

Hopefully you can take a look at this. I don't think I could bear to access 2+2 from my phone's browser or Tapatalk.

Thanks.