#18160: Unable to access wiki.openwrt.org properly via HTTPS
-------------------------------------------------+-------------------------
Reporter: alive4ever@… | Owner:
Type: defect | Status: new
Priority: highest | Milestone:
Component: website | Version: Trunk
Keywords: https tls wiki certificate-error |
mixed-contents |
-------------------------------------------------+-------------------------
Since wiki.openwrt.org is the main information source for OpenWrt related
stuff, it's required that wiki.openwrt.org is accessible via HTTPS. It's
also better to enforce HTTPS by redirection and HSTS.
Why? Because the wiki needs to maintain the integrity of information it
provides, either for users or wiki contributors.
It's good that other OpenWrt sites, such as forum, main site, and track,
are available via HTTPS.
Currently, HTTPS is accessible on wiki.openwrt.org, but with certificate
errors (Self-signed, domain mismatch) and mixed contents (static contents
served from non HTTPS source, still using HTTP for POST), which greatly
reduces the HTTPS usefulness for the wiki.openwrt.org site.
Some good wiki examples are [https://wiki.debian.org] and
[https://wiki.archlinux.org]. They implement HTTPS properly for the wiki
site. They are under the same organization as OpenWrt (SPI, inc), so that
I think there is no problem with the organization validity.
For your information, enabling HTTPS doesn't give any impact on server
performance. [https://istlsfastyet.com]
In case the webmaster doesn't know how to setup HTTPS properly, here is
Google's presentation about "HTTPS everywhere"
[https://docs.google.com/presentation/d/15H8Sj-
Zol1tcum0CSylhmXns5r7cvNFtzYrcwAzkTjM/present].
This problem should be taken seriously and fixed as soon as possible.
--
Ticket URL: <https://dev.openwrt.org/ticket/18160>
OpenWrt <http://openwrt.org>
Opensource Wireless Router Technology
_______________________________________________
openwrt-tickets mailing list
[email protected]
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-tickets
