{"id":4685,"date":"2016-02-29T08:56:30","date_gmt":"2016-02-29T13:56:30","guid":{"rendered":"https:\/\/www.highedwebtech.com\/?p=4685"},"modified":"2016-02-28T15:31:23","modified_gmt":"2016-02-28T20:31:23","slug":"new-theme-https-and-http2","status":"publish","type":"post","link":"https:\/\/www.highedwebtech.com\/2016\/02\/29\/new-theme-https-and-http2\/","title":{"rendered":"New Theme, HTTPS, and HTTP\/2"},"content":{"rendered":"

I’ve long been a believer that the best way to learn something is to try it and make mistakes and figure it out as you go. I’ve done that recently with this blog.<\/p>\n

After many years of hosting this blog at two shared hosts, HostGator and Site5, I’ve moved this site to a VPS at DigitalOcean<\/a>. I’ve been a customer there for several years, host many web sites for both my professional and personal projects, and very much enjoy their service. The nerd in me thinks its just super cool that I have servers running at DigitalOcean in New York, San Francisco, and London.<\/p>\n

I also wanted to and squeak out as much performance as I could from a $5 server. So, in order to learn how it works, I’ve setup Nginx to serve as a reverse proxy in front of Apache. Nginx is super fast at serving static files, and Apache is good at dynamic stuff but is a memory hog, so you can try and tweak the two to work efficiently together. Don’t want to mess with all that configuration and setup? I very highly recommend Serverpilot<\/a>. It basically sets all this up for you if you use Ubuntu on your server. I’ve been a paying customer for a few months and love the service.<\/p>\n

In the spirit of learning, I wanted to learn how to set up SSL with Let’s Encrypt<\/a>. Let’s Encrypt\u00a0is a new service offering free SSL certificates that you issue and revoke via the command line. They’ve made getting and installing SSL certificates brain-dead easy, which is good because otherwise it’s a difficult process with many steps that could lead to errors.<\/p>\n

Why SSL? That little padlock is pretty, sure, but more importantly, Google is using HTTPS as one of its magical ranking factors when it reviews a site<\/a>. Given the state of security and personal information, if you are collecting any data from your users, you should be doing that over HTTPS to protect your user’s information, especially with information like credit cards, addresses, personal information and more. It’s trivial to get setup, so if you can, you should.<\/p>\n

Is HTTPS critical for this site? Not really. I don’t collect information, but setting up something like Let’s Encrypt to distribute an SSL certificate to me was so easy, why not. I hope more shared web hosts will offer a service like Let’s Encrypt to it’s users.<\/p>\n

To use Let’s Encrypt, you’ve got to first install it on your server.\u00a0You’ll need to close the git repository first.<\/p>\n

sudo git clone https:\/\/github.com\/letsencrypt\/letsencrypt \/opt\/letsencrypt<\/code><\/p>\n

Switch to that directory, and at a basic level, just run this command:<\/p>\n

.\/letsencrypt-auto<\/code><\/p>\n

You’ll be walked through the setup. If you want to skip some of those steps, you can do it via the command line:<\/p>\n

.\/letsencrypt-auto certonly --standalone --email [YOUR_EMAIL] -d [YOUR_DOMAIN] -d [YOUR_DOMAIN_WITH_WWW]<\/code><\/p>\n

This will generate your certificates, but then it’s up to you to configure Nginx or Apache to use them.<\/p>\n

Let’s Encrypt is great – but there’s a catch. You must renew the certificates every 90 days. Doing so isn’t hard, just run that .\/letsencrypt-auto<\/code> script again. Better yet, you can set up a script that checks and renews certificates and set it as a CRON job. No worries.<\/p>\n

Between NGINX and my Let’s Encrypt certificate, I got an A+<\/a> on the Qualys SSL test<\/a>. Aw yiss.<\/p>\n

\"Screenshot<\/a><\/p>\n

Here’s the challenge about HTTPS: you’ve got to go all-or-nothing or you’ll get mixed content warnings on your site. If you’re using default WordPress and not using a service like a CDN, adding SSL won’t be a big deal. If you’re hot linking images from another site, you may have a problem. Most image services are moving to HTTPS, including the Photon image hosting service available as part of WordPress’ JetPack<\/a> service.<\/p>\n

As I turned on HTTPS, I ran into issues because I host my uploaded content at Amazon<\/a> and have a custom CNAME that points to a CloudFront distribution. In English, my image uploads are moved to an Amazon S3 bucket, then distributed via their CloudFront CDN, but instead of using their cloud front.com domain name, I made my own: cdn.hewt.in. I have not setup SSL for that domain, so I’ve decided to use the domain name Amazon gave me for my CloudFront distribution, which does over SSL. HTTPS images sorted.<\/p>\n

This also covered my other assets I serve from CloudFront, including javascripts, CSS, and other static site assets. If you aren’t serving stuff from a content delivery network like CloudFront, MaxCDN, KeyCDN, or others, you should. Faster is always better, especially if you are hosting on a shared host. The more you can offload from the shared host, the better.<\/p>\n

\"Screenshot<\/p>\n

Here’s another fun thing I’m trying. This site is now available over HTTP\/2. Many\u00a0browsers now support HTTP\/2. HTTP\/2 is different, sure, but why. The HTTP\/2 site says this<\/a>:<\/p>\n

At a high level, HTTP\/2:<\/p>\n