HTTPS Upgrade Guide

This article describes how to upgrade an HTTP Web site to HTTPS.

First, obtain the certificate
The first step in upgrading to the HTTPS protocol is to obtain a certificate.
A certificate is a binary file that contains a certified public key and some meta data to be purchased from a reseller.
Gogetssl
Ssls.com
Sslmate.com
There are many types of certificates, first divided into three levels of authentication.

Domain Validation: The lowest level of certification, you can confirm that the applicant owns the domain name. For such a certificate, the browser displays a lock in the address bar.
Company Validation: Confirm which company the domain name owner is, and the certificate contains company information.
Extended certification (Extended Validation): The highest level of authentication, the browser address bar displays the company name.
Also divided into three kinds of coverage.
Single Domain certificate: only for single domain name, foo.com certificate cannot be used for www.foo.com
Wildcard Certificate: Can be used for a domain name and all of its primary sub-domains, such as *.foo.com certificates can be used for foo.com, or can be used for www.foo.com
Multi-Domain Certificate: can be used for multiple domain names, such as foo.com and bar.com
The higher the certification level, the more extensive the coverage of the certificate, the more expensive the price.
There is also a choice of free certificates. To promote the HTTPS protocol, the Electronic Sentinel Foundation EFF established let's Encrypt, which provides free certificates (tutorials and tools).
After you get the certificate, you can check with SSL Certificate to see if the information is correct.
Second, installation certificate
The certificate can be placed in the/etc/ssl directory (Linux system) and then configured according to the Web server you are using.
Certificate configuration file Generator, by Mozilla
Configuration file Template by Sslmate
If you use let's Encrypt certificate, use the Auto-install tool Certbot.
After the installation is successful, use SSL Labs Server test to check that the certificate is in effect.
Third, modify the link
Next, the Web page loaded HTTP resources, to all change to HTTPS link. The browser does not load those resources if there are non-encrypted resources within the encrypted Web page.

<script src= "Http://foo.com/jquery.js" ></script>
The above line loads the command, and there are two ways to change it.

<!--modification
<script src= "Https://foo.com/jquery.js" ></script>

<!--modification Two--
<script src= "//foo.com/jquery.js" ></script>
Among them, the second will be based on the current Web page protocol, load the same protocol external resources, more flexible.
In addition, if the page head uses the rel= "canonical", also must change to HTTPS URL.

<link rel= "canonical" Href= "https://foo.com/bar.html"/>
Four, 301 redirects
Next, modify the WEB server's configuration file and use 301 redirects to direct the HTTP protocol's access to the HTTPS protocol.
The wording of Nginx.

server {
Listen 80;
server_name domain.com www.domain.com;
return 301 Https://domain.com$request_uri;
}
The Apache notation (. htaccess file).

Rewriteengine on
Rewritecond%{https} off
Rewriterule (. *) Https://%{http_host}%{request_uri} [R=301,l]
V. Security measures
The following measures can further ensure the security of communications.
5.1 HTTP Strict Transport Security (HSTS)
When visiting a website, users rarely enter https://directly into the address bar, always by clicking on a link, or by 3xx redirection, from the HTTP page to the HTTPS page. An attacker could hijack and tamper with the request when the user makes an HTTP request.
Another scenario is when a malicious Web site uses a self-signed certificate to impersonate another site, and the browser gives a warning, but many users ignore the warning to continue accessing it.
The role of HTTP strict transport security (HSTS) is to force the browser to issue only HTTPS requests and prevent users from accepting unsafe certificates.
It adds a mandatory statement inside the response header of the website. The following example is excerpted from Wikipedia.

strict-transport-security:max-age=31536000; Includesubdomains
The above header information has two functions.
(1) in the following year (that is, 31.536 million seconds), the browser must use HTTPS to initiate a connection whenever it sends an HTTP request to example.com or its subdomains. When the user clicks the hyperlink or enters http://www.example.com/in the address bar, the browser should automatically turn HTTP to HTTPS and send the request directly to https://www.example.com/.
(2) in the following year, if the certificate sent by the example.com server is invalid, the user cannot ignore the browser warning and will not be able to continue accessing the site.
HSTS to a large extent resolves the SSL Peel attack. As long as the browser has established a secure connection with the server, then the browser enforces HTTPS, even if the link is replaced with HTTP.
The main disadvantage of this approach is that users are not protected from HSTs when they first visit the site to make an HTTP request.
If you want to fully analyze the security of your website, you can use Mozilla's Observatory.
5.2 Cookies
Another area to note is to ensure that the browser only sends cookies when using HTTPS.
Inside the Web response header, the Set-cookie field is added with the secure flag.

Set-cookie:lsid=dqaaak ... Eaem_vyg; Secure

HTTPS Upgrade Guide