Delivering the news
over HTTPS
Paul Schreiber@paulschreiber
HTTP1991–2015
HTTP1991–2015
Marking HTTP As Non-Secure
We, the Chrome Security Team, propose that user
agents (UAs) gradually change their UX to
display non-secure origins as affirmatively
non-secure. We intend to devise and begin
deploying a transition plan for Chrome in 2015.
The goal of this proposal is to more clearly display
to users that HTTP provides no data security.
Marking HTTP As Non-Secure
We, the Chrome Security Team, propose that user
agents (UAs) gradually change their UX to
display non-secure origins as affirmatively
non-secure. We intend to devise and begin
deploying a transition plan for Chrome in 2015.
The goal of this proposal is to more clearly display
to users that HTTP provides no data security.
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out
non-secure HTTP.
There are two broad elements of this plan:
1. Setting a date after which all new features will be
available only to secure websites
2. Gradually phasing out access to browser
features for non-secure websites, especially
features that pose risks to users’ security and
privacy.
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out
non-secure HTTP.
There are two broad elements of this plan:
1. Setting a date after which all new features will be
available only to secure websites
2. Gradually phasing out access to browser
features for non-secure websites, especially
features that pose risks to users’ security and
privacy.
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out
non-secure HTTP.
There are two broad elements of this plan:
1. Setting a date after which all new features will be
available only to secure websites
2. Gradually phasing out access to browser
features for non-secure websites, especially
features that pose risks to users’ security and
privacy.
The HTTPS-Only Standard
All browsing activity should be considered
private and sensitive.
—https.cio.gov
A Call to Action
If you run a news site, or any site at all, we’d like
to issue a friendly challenge to you. Make a
commitment to have your site fully on HTTPS by
the end of 2015 and pledge your support with
the hashtag #https2015.
—Eitan Konigsburg, Rajiv Pant and Elena Kvochko
“Embracing HTTPS”
November 13, 2014
HTTP
HTTPS
HTTPS
example.com
single
example.com
greeneggsham.info
wordpressfan.biz
SAN
example.com
beta.example.com
shoebox.example.com
wildcard
SGC
domain
validation
organization
validation
extended
validation
extended
validation
Selected DV Certificates
Comodo PositiveSSL
Comodo SSL
Thawte SSL123
0 32 64 96 128 160
149
99
49
PositiveSSL DV Certificates
SSLs.com
SSLMate
Comodo
0 32 64 96 128 160
49
15.95
8.95
Selected Certificates
Let’s Encrypt
PositiveSSL (SSLs.com)
GeoTrust QuickSSL Premium
Thawte SSL123
GeoTrust True BusinessID
Symantec Secure Site
Symantec Secure Site Pro EV
0 300 600 900 1200 1500
1400
399
199
149
99.98
8.95
0
$	sslmate	mkconfig
https://mozilla.github.io/	
server-side-tls/	
ssl-config-generator/
https://github.com/
tollmanz/lets-encrypt-wp
$	wp	cert	new
HTTPS enabled
HTTPS enabled
HTTPS default
HTTPS enabled
HTTPS default
HSTS
HTTPS enabled
HTTPS default
HSTS
HSTS preload
SNI
SHA1vs
SHA2
content
content
😕
comments
ads
social
analytics
CDNs
fonts
2008 HTTPS is slow
2008 HTTPS is slow
2015 HTTPS is fast
HTTP 2.0
HTTPS
1.88X
per http2.loadimpact.com
mixedcontent
mixedcontent
$	mixed-content-scan
mixedcontent
Content-Security-Policy:	
		upgrade-insecure-requests
mixedcontent Content-Security-Policy-
Report-Only:	default-src	
https:	data:	'self'	
'unsafe-inline'	'unsafe-
eval';	report-uri:	
https://myserver.com/log-
tool/
NoHTTPS?
ask
nicely.
NoHTTPS?
SoundCite
placehold.it
mixedcontent
Akamai
http://hostname.com	→	
https://a248.e.akamai.net/f/
12/621/60d/hostname.com
<script	src="//google.com/…	
<script	src="https://googl…
mixedcontent
<script	src="//google.com/…	
<script	src="https://googl…
mixedcontent
mixedcontent
Many graphics from The Noun Project

Tombstone by Jakob Wells. Congress by Martha Ormiston.
Shield by Wayne Thayer. Snail by aLf. Server by Yazmin
Alanis. SEO by Azis. Money by Nick Levesque. Warning by
Icomatic. Shopping cart by Patrizia Daidone. Lock with
keyhole by Brennan Novak. Scribble by Michael Chanover.
Calendar by Mani Amini. Error by Anas Ramadan. Network by
Stephen Boak. Hat based on work by Blake Kimmel.

WordCamp US: Delivering the news over HTTPS