HTTPS

Question

HTTPS

lgarron opened this issue 7 years ago · comments

Chrome will mark http://spec.commonmark.org/dingus/ as "Not secure" starting in October:
https://blog.chromium.org/2017/04/next-steps-toward-more-connection.html

Would it be possible to update commonmark.org and its subdomains to use HTTPS by then?

AJ Jordan · Answer 1 · Fri Feb 16 2018 00:40:21 GMT+0800 (China Standard Time)

Looks like, as usual, isaacs/github#156 is a blocker for this. (Though as has been said many times on that issue, please don't leave +1s.)

However I can access the spec itself over HTTPS just fine? Not sure what's going on there.

John MacFarlane · Answer 2 · Thu May 03 2018 23:54:45 GMT+0800 (China Standard Time)

I believe this has now been fixed by some behind-the-scenes GitHub changes.
At any rate, visiting the spec website with https now seems to work!

AJ Jordan · Answer 3 · Fri May 04 2018 03:14:59 GMT+0800 (China Standard Time)

Shouldn't someone turn on automatic redirects?

Lucas Garron · Answer 4 · Fri May 04 2018 04:40:17 GMT+0800 (China Standard Time)

At any rate, visiting the spec website with https now seems to work!

Indeed, the spec website works over HTTPS!

https://commonmark.org/ still doesn't work, though. :-(
And as @strugee mentioned, it would be best to redirect to HTTPS.

John MacFarlane · Answer 5 · Fri May 04 2018 05:16:10 GMT+0800 (China Standard Time)

Can you tell me how? AJ Jordan <notifications@github.com> writes:

…

Shouldn't someone turn on automatic redirects? -- You are receiving this because you modified the open/close state. Reply to this email directly or view it on GitHub: #7 (comment)

Lucas Garron · Answer 6 · Fri May 04 2018 05:24:04 GMT+0800 (China Standard Time)

There should be an "Enforce HTTPS" checkbox in settings:
https://blog.github.com/2018-05-01-github-pages-custom-domains-https/

John MacFarlane · Answer 7 · Fri May 04 2018 06:30:48 GMT+0800 (China Standard Time)

Done. I don't have any control over the main commonmark.org site, that's @coding-horror. Lucas Garron <notifications@github.com> writes:

…

There should be an "Enforce HTTPS" checkbox in settings: https://blog.github.com/2018-05-01-github-pages-custom-domains-https/ ![](https://blog.github.com/assets/img/2018-05-01-github-pages-custom-domains-enforce-https.png) -- You are receiving this because you modified the open/close state. Reply to this email directly or view it on GitHub: #7 (comment)

AJ Jordan · Answer 8 · Fri May 04 2018 08:16:19 GMT+0800 (China Standard Time)

Thanks @jgm! This is great.