FreewayTalk

12 replies to this thread. Most Recent

Victor

9 May 2020, 10:38 am

[Pro] Freeway https

Hi again. I would like to make my site above secure as in https. I have downloaded the freeway action HTTPS CDN helper and I know I can apply that action to all pages of the website (There are not many) I use Cloudflare free SSL to generate a free SSL (I have not set this up yet with cloudflare as I know I must point the domain to cloudflare but I dont want to do that yet until I know how to set it up correctly) After i apply the action I dont know what to do next with freeway or Cloudflare. Has anyone used this action and cloudflare or another free ssl and converted their freeway site to https successfully and let me know what method and order I need to do to do this properly without breaking the website. Thanks in advance Victor

http://eltorosalou.com

waltd

9 May 2020, 3:38 pm

Sure. I have used this combination with my Rails sites, and from the setup perspective, that’s identical.

To begin, add your domain to CloudFlare. They will automatically import whatever your current DNS host has set up as far as machine names and services. On the DNS tab for the new domain, you should see the name servers that they have assigned to you.

In my setup for ActionsForge, I have that domain pointed to kim.ns.cloudflare.com and paul.ns.cloudfalre.com. Your mileage may vary.

Once you’ve set that up, log in wherever you registered your domain. There should be a simple setting to point the domain at Cloudflare instead of using your previous DNS (which may, for convenience sake, be the domain registrar). This doesn’t change anything about your registration, just where the domain name is mapped over to the numerical address system (IP) of the Internet. There is no requirement that your domain be registered by the same company that manages DNS.

At this point, your site should still be working. If it isn’t, go outside and wash the car or something, because refreshing your browser and swearing will not change anything. The Domain Name System is distributed, which means that each node needs to synch with all the others before there is a clear and consistent picture of which names map to which servers. Time heals all wounds, and routing errors.

Finally, to switch to SSL on your site, without changing anything else about your Web server, simply move to the SSL/TLS tab of Cloudflare, and switch the mode from Off (default) to Flexible. This should start working right away, Note that this only encrypts traffic between the browser and CloudFlare, not between CloudFlare and your server. This is correct and okay, unless you handle money or secrets, in which case you must set up SSL on your Web server, so that the entire signal chain is encrypted. If you do that, then you would change the settings from Flexible to Full (strict), but only after you have completed the setup of SSL on your Web server.

CloudFlare sits between your server and the browser clients on the wider Web. They provide a distributed CDN, which speeds up the delivery of your site around the world. They also can automatically compress your site resources, which further speeds things up. And if you get attacked by a DDOS, they will automatically respond by denying the attackers. It’s a good thing to have, whether or not you need SSL.

Walter

On May 9, 2020, at 6:38 AM, Victor <[email protected]> wrote:

Hi again. I would like to make my site above secure as in https. I have downloaded the freeway action HTTPS CDN helper and I know I can apply that action to all pages of the website (There are not many) I use Cloudflare free SSL to generate a free SSL (I have not set this up yet with cloudflare as I know I must point the domain to cloudflare but I dont want to do that yet until I know how to set it up correctly) After i apply the action I dont know what to do next with freeway or Cloudflare. Has anyone used this action and cloudflare or another free ssl and converted their freeway site to https successfully and let me know what method and order I need to do to do this properly without breaking the website. Thanks in advance Victor

http://eltorosalou.com

Freeway user since 1997

http://www.walterdavisstudio.com

Victor

9 May 2020, 4:11 pm

Hi Walter. Once again thank you for your speedy reply. I am going to have a go at that after the weekend and try to be patient! I think I understand it as I sort of have to do the same thing with my wordpress sites. Only one question. If I successfully do all the bits above do I need to use the freeway action HTTP CDN helper or not. Thanks for your help. Cheers Victor

waltd

9 May 2020, 5:10 pm

You will have to do that. As a start, you should apply the Action now, and make sure (by visiting your site, and viewing source) that the URLs to all external resources (like the Google CDN or the Freeway CDN) are being rewritten as https://. There is no error possible in including an HTTPS resource within an otherwise HTTP page. What fails, utterly, is trying to include hosted scripts from an HTTP endpoint within an HTTPS-hosted page.

So if you’re looking for something you can do right now, without hurting anything or needing any extra resources, apply that Action to all pages in your site, make sure that it’s switched “on” on all pages, and then publish the site. Manually inspect the HTML files with a text editor from your Mac, or simply publish to your server and visit the page and view source (in Safari, enable the Develop menu in the Advanced tab of the Safari Preferences dialog, then choose Develop/Show Page Source from the main menu) while you are visiting the page.

What you want to ensure is that any tags in the page HEAD look like this:

<script srce="https://... or <link href=”https://…If you find any that begin withhttp://instead, then you'll have to figure out why that's happening. My Action will rewrite the common references to the Google CDN and the FreewayPro CDN, but it will definitely miss any references you may have hand-coded using the Page / HTML Markup dialog or similar.Note that you don't need to worry about any links or scripts that don't include a protocol prefix. Freeway will write links and script tags that don't include a protocol, and either begin withResourcesor some other bare word, or../`. These will inherit whatever protocol the page is hosted under, so you won’t need to rewrite those.Walter> On May 9, 2020, at 12:11 PM, Victor <[email protected]> wrote:

Hi Walter. Once again thank you for your speedy reply. I am going to have a go at that after the weekend and try to be patient! I think I understand it as I sort of have to do the same thing with my wordpress sites. Only one question. If I successfully do all the bits above do I need to use the freeway action HTTP CDN helper or not. Thanks for your help. Cheers Victor

Freeway user since 1997

http://www.walterdavisstudio.com

Victor

15 May 2020, 1:34 pm

Hi Walter. I have done the first step and applied the CDN Helper on every page including the master and I assume that selecting a page, applying the action and ticking the box in the actions window that says (use HTTPS links to google or freeway pro CDN) on every page means that the action is enabled. I then saved rechecked several times and uploaded the site and checked Safari developer show page source and every page I check shows up still on (http.) I have checked it several times and cleared my history and cashe and checked it in other browsers and it is still the same. I have only used Freeway and no special coding or anything like that so I dont understand why it´s not working. Can you have a look at the site at your end eltorosalou.com and see if it shows any https or am I not applying the action correctly. I cant seem to upload any images on this forum but I have images of the way I set it up in freeway and the actions window and the safari page source if you give me a mail address to send them to. My email address is [email protected] Thank you Victor

waltd

15 May 2020, 1:41 pm

I clicked around all the pages I could see in the UK (english) section. I don’t see any links in the page head to external scripts. I do see an iframe to a Google Maps virtual tour, and that is properly linked to HTTPS.

If you were expecting this Action to set up HTTPS on your server, I’m afraid that won’t do it. You’ll need to work with your hosting provider to ensure that your site is hosted securely. Happily, nothing about your site (that I could see in my 3 minutes of clicking) will stop that from being successful.

Walter

On May 15, 2020, at 9:34 AM, Victor <[email protected]> wrote:

Hi Walter. I have done the first step and applied the CDN Helper on every page including the master and I assume that selecting a page, applying the action and ticking the box in the actions window that says (use HTTPS links to google or freeway pro CDN) on every page means that the action is enabled. I then saved rechecked several times and uploaded the site and checked Safari developer show page source and every page I check shows up still on (http.) I have checked it several times and cleared my history and cashe and checked it in other browsers and it is still the same. I have only used Freeway and no special coding or anything like that so I dont understand why it´s not working. Can you have a look at the site at your end eltorosalou.com and see if it shows any https or am I not applying the action correctly. I cant seem to upload any images on this forum but I have images of the way I set it up in freeway and the actions window and the safari page source if you give me a mail address to send them to. My email address is [email protected] Thank you Victor

Freeway user since 1997

http://www.walterdavisstudio.com

Victor

15 May 2020, 2:19 pm

Hi Walter. I was not expecting the Freeway CDN helper to convert my site with an SSL cert I do not use my hosting company For my SSL because they will charge me for this. Like you said I use cloudflare for setting up an SSL. So normally set it up the way you described above with Cloudflare. 1. set up with Cloudflare, put my domain in and click to add my site and then use their nameservers, in my case kurt.ns.cloudflare.com nena.ns.cloudflare.com then go to my domain register and point the domain to Cloudflare and then once that takes effect go to the SSL/TLS tab of Cloudflare, and switch the mode from Off (default) to Flexible. The only difference is with wordpress I normally have to use a plugin called (Really simple ssl) to force the ssl to take effect. My only confusion is you said I had to set up the CDN helper in freeway and then to inspect it using Safari and I thought you meant before I set up the SSL with Cloudflare or did you mean after to make sure all the pages and links converted to https. So to sum up. I have enabled the Freeway CDN helper on every page of the site When you looked at my site you saw nothing that would cause a problem with going ahead and setting things up with Cloudflare and pointing my domain from the domain register to cloudflare and it should all be automatic. I know I´m being probably over cautious but I don´t want to break the site. Once again thank you for all your help. Victor

Victor

15 May 2020, 2:19 pm

Hi Walter. I was not expecting the Freeway CDN helper to convert my site with an SSL cert I do not use my hosting company For my SSL because they will charge me for this. Like you said I use cloudflare for setting up an SSL. So normally set it up the way you described above with Cloudflare. 1. set up with Cloudflare, put my domain in and click to add my site and then use their nameservers, in my case kurt.ns.cloudflare.com nena.ns.cloudflare.com then go to my domain register and point the domain to Cloudflare and then once that takes effect go to the SSL/TLS tab of Cloudflare, and switch the mode from Off (default) to Flexible. The only difference is with wordpress I normally have to use a plugin called (Really simple ssl) to force the ssl to take effect. My only confusion is you said I had to set up the CDN helper in freeway and then to inspect it using Safari and I thought you meant before I set up the SSL with Cloudflare or did you mean after to make sure all the pages and links converted to https. So to sum up. I have enabled the Freeway CDN helper on every page of the site When you looked at my site you saw nothing that would cause a problem with going ahead and setting things up with Cloudflare and pointing my domain from the domain register to cloudflare and it should all be automatic. I know I´m being probably over cautious but I don´t want to break the site. Once again thank you for all your help. Victor

waltd

15 May 2020, 3:29 pm

If you type in https:// before the domain name, then the site comes up under secure mode, everything works fine.

What you will need to do on your server is set up a redirect from non-secure to secure. This is usually done with an .htaccess file. Before you do this, check with your hosting provider if they support mod_redirect in an .htaccess file. If they do, it’s relatively easy.

You’ll need a SFTP application, like Transmit or CyberDuck. You’ll also need a programmer’s text editor like BBEdit or Textmate. Armed with those, you want to use the SFTP application to navigate into your hosting provider’s server, locate the site root (the directory that contains the index.html file) and with the “Show hidden files” setting On, locate an existing .htaccess file, if one exists. If you find one, use your SFTP application to make a duplicate (backup) and then open it in place for editing. You may also want to download a copy of the original file for safe-keeping. NOTE: You will be prevented from saving a file on your Mac with a filename that begins with a dot. You’ll need to rename it something like htaccess.txt.

If there isn’t an .htaccess file on your server, just open a new text file and follow along.

If you’re working with an existing .htaccess file, check to see what’s already in it. You don’t want to break existing content — may hosting providers use this file for lots of service-specific settings. If you see any mention of Rewrite in that file already, copy and paste it here, and I’ll try to help you sort that out.

If this is a new file, or if there’s not another mention of Rewrite already in that file, paste in the following code:

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) <https://%{HTTP_HOST}%{REQUEST_URI}>

Save the file, and immediately visit your site on the http:// prefix. You should be silently redirected to the https:// prefix.

If instead you see a blank page, or a Internal Server Error alert, restore the original .htaccess (or remove the one you just added) and we’ll try to diagnose further.

Walter

On May 15, 2020, at 10:19 AM, Victor <[email protected]> wrote:

Hi Walter. I was not expecting the Freeway CDN helper to convert my site with an SSL cert I do not use my hosting company For my SSL because they will charge me for this. Like you said I use cloudflare for setting up an SSL. So normally set it up the way you described above with Cloudflare. 1. set up with Cloudflare, put my domain in and click to add my site and then use their nameservers, in my case kurt.ns.cloudflare.com nena.ns.cloudflare.com then go to my domain register and point the domain to Cloudflare and then once that takes effect go to the SSL/TLS tab of Cloudflare, and switch the mode from Off (default) to Flexible. The only difference is with wordpress I normally have to use a plugin called (Really simple ssl) to force the ssl to take effect. My only confusion is you said I had to set up the CDN helper in freeway and then to inspect it using Safari and I thought you meant before I set up the SSL with Cloudflare or did you mean after to make sure all the pages and links converted to https. So to sum up. I have enabled the Freeway CDN helper on every page of the site When you looked at my site you saw nothing that would cause a problem with going ahead and setting things up with Cloudflare and pointing my domain from the domain register to cloudflare and it should all be automatic. I know I´m being probably over cautious but I don´t want to break the site. Once again thank you for all your help. Victor

Freeway user since 1997

http://www.walterdavisstudio.com

Victor

15 May 2020, 4:12 pm

Hi Walter. As I have never done any coding or edited files on my server etc. everything after your first sentence is over my head, that was why I used Freeway so not to have to do any of this kind of stuff. So after the first sentence I will have to look all of this up online and possibly do it with help from the support at my hosting provider.

So if I do the Cloudflare and point the domain name what is the worst that will happen. Will it just be that the site will still just come up as not secure but will still work or will the site go down!!. As long as I don´t break the site by trying the ssl and it doesn´t go to secure I don´t mind and I will attempt the next part by myself or with the hosting company. So should I try the ssl first and see if it works. Sorry and thanks Victor

Victor

15 May 2020, 4:13 pm

Hi Walter. As I have never done any coding or edited files on my server etc. everything after your first sentence is over my head, that was why I used Freeway so not to have to do any of this kind of stuff. So after the first sentence I will have to look all of this up online and possibly do it with help from the support at my hosting provider.

So if I do the Cloudflare and point the domain name what is the worst that will happen. Will it just be that the site will still just come up as not secure but will still work or will the site go down!!. As long as I don´t break the site by trying the ssl and it doesn´t go to secure I don´t mind and I will attempt the next part by myself or with the hosting company. So should I try the ssl first and see if it works. Sorry and thanks Victor

waltd

15 May 2020, 4:27 pm

If you type https:// into your browser and then enter the rest of your domain name, your site will come up as secure. Many browsers already do this for you, they assume that you mis-typed if you use the http variant. If you update all referring links to your site to be secure links, then there’s nothing else for you to do. Your server (from your hosting provider’s perspective) is configured correctly.

The .htaccess bit is a nice-to-have, that automatically corrects incoming requests for you. CloudFlare has an option in their control panel that will do this auto-correct there, you may want to try that. I had trouble with it the last time I tried, but admittedly, that was a while ago, and not in a normal Apache web server context.

Walter

On May 15, 2020, at 12:12 PM, Victor <[email protected]> wrote:

Hi Walter. As I have never done any coding or edited files on my server etc. everything after your first sentence is over my head, that was why I used Freeway so not to have to do any of this kind of stuff. So after the first sentence I will have to look all of this up online and possibly do it with help from the support at my hosting provider.

So if I do the Cloudflare and point the domain name what is the worst that will happen. Will it just be that the site will still just come up as not secure but will still work or will the site go down!!. As long as I don´t break the site by trying the ssl and it doesn´t go to secure I don´t mind and I will attempt the next part by myself or with the hosting company. So should I try the ssl first and see if it works. Sorry and thanks Victor

Freeway user since 1997

http://www.walterdavisstudio.com

Back to Top

Victor

15 May 2020, 5:33 pm

Thank Walter I got a bit frightened by the .htaccess bit but as you said I can try it in Cloudflare or my support people at Hostinger are a fairly helpful bunch so maybe they will do it for me. Anyway I will have a go at part A (Cloudflare and the Domain Register) and fill you in on how I got on. Once again thanks very much for all your help and Have a Great Weekend Cheers Victor