31-Jul-2012 (Tue)
Wherein SSL is reconfigured.

It was time to renew our SSL certificate, so we took this opportunity to move the store from cart.dnalounge.com to www.dnalounge.com. (A decade ago, they were different machines, but they've been hosted on the same server for quite some time now.) A side-effect of this is that the whole web site is accessible via HTTPS now. You know, if you're paranoid about people snooping you as you browse our calendar or something.

Please let me know if you notice any problems, particularly any warnings like "secure page loaded insecure content".

Attention staff and promoters: check your bookmarks. Change any occurrences of "cart" or "cerebrum" to "www".

12 Responses:

  1. John Bloom says:

    Couple things I noticed:
    When I visit (for example) the DIRECTIONS page via HTTPS, then click the CALENDAR link, I'm 302 redirected to HTTP. Not sure if that's intentional. (Best way to see it is with Safari or Chrome's 'Network' tab in the developer tools window).
    Also, Chrome seems to think something is being loaded insecurely on this page: https://www.dnalounge.com/calendar/2012/07-05.html
    Maybe the thumbnail on the youtube clip?
    Also, a question on housekeeping: Would you rather that dnalounge comments stayed on dnalounge.com or is here fine?

    • jwz says:

      Thanks, I've fixed the video thing.

      I don't see any way to fix the "Calendar" thing because the way that works is there is a line in .htaccess that says:
      Redirect 302 /calendar/latest.html http://www.dnalounge.com/calendar/2012/08.html
      and leaving off the protocol, making it //www.dnalounge.com/..., doesn't work. Redirect directives need to be fully-qualified URLs.

      Doesn't matter to me where you comment.

      • Adam says:

        Redirect directives need to be fully-qualified URLs.

        The manual says: " The new URL should be an absolute URL beginning with a scheme and hostname, but a URL-path beginning with a slash may also be used, in which case the scheme and hostname of the current server will be added." - Apache 2.2, Redirect.

        Which sounds like "Redirect 302 /calendar/latest.html /calendar/2012/08.html" should work; this is in line with the example under "Discussion" here Apache 2.2, Rewriting From Old to New: "Redirect /foo.html /bar.html"

  2. harryh says:

    When loading this blog entry in via https I get an insecure content warning and then if I ignore that disqus fails to load.

    • Jamie Zawinski says:

      Ugh, this looks to be a bug in Disqus itself... I'm definitely loading their .js over https but they're emitting an http iframe anyway.

  3. harryh says:

    The embedded YouTube videos you have on some of your ticket pages (like this one https://www.dnalounge.com/calendar/2012/09-12.html ) are being loaded via HTTP instead of HTTPS which will cause insecure content warnings in some browsers.

  4. Jason Heilig says:

    I'm late to the party here, but when did you get rid of the whole "house of ill repute" style shirts? I forgot the actual quote, but I didn't see it in the shop.

  5. Seg says:

    Besides this comment stuff, everything seems to be in order for HTTPS!