The SSL nightmare

[larry45]

Does anyone have experience going SSL with a site with a lot of inner pages? What service did you use? Did you have to do redirects in advance to maintain you SEO search results? Thanks.

[BenPleysier]

Once the certificate is active, in the .htaccess file put the following

RewriteEngine On

RewriteCond %{HTTPS} !=on

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

or

RewriteEngine On

RewriteCond %{SERVER_PORT} 80

RewriteRule ^(.*)$ https://examplesite.com/$1 [R=301,L]

Edit: I use Let's Encrypt, but there are many others out there, just Google the subject.

[larry45]

Understand very little there.

[larry45]

I've heard Let's Encrypt is very draining and non intuitive and requires a fresh round of nuisance every 3 months.

[BenPleysier]

Get in touch with your host, they may have a ready made solution for you.

To illustrate, this is my server which has the option to get a Let's Encrypt certificate.

Once the certificate has been obtained - instantaneously - the certificate can be attached to the web site and a redirection can be set without having to resort to entries in .htaccess

The certificate is valid for 3 months when it will be renewed automatically.

If your host is not as accommodating as mine, then Google the subject, get a certificate of your choice, apply it to your website and use the re-direct method as explained. With this, I have assumed that you are on an Apache type server. If you are on a Windows server, you will have to place the redirect in web.config.

[osgood_]

I use 'Let Encrypt' as well, any reasonable cPanel/Plesk hosting should have it installed by default and its quite easy to implement. If it doesnt work after clicking through the deployment procedure then contact your host....I had to on a couple of ocassions and they put it right in a few seconds.

After that, or before, you need to make sure any http:// links in your website are converted to https:// with the exception of external links to other sites, which you cant do anything about if they dont have a secure https:// url

Then as Ben has shown you need to include the rewrite direct code in your .htaccess file.

[larry45]

None of this is helping at all as this is totally over my head and I have thousands of inner pages that will not work the minute the SSL does work that is if whoever I hire can even do the first part ok.

Godaddy who host is worthless. They charge a lot and know nothing. I've talked to 5-6 reps.

If anyone knows a great service I'll pay.

[osgood_]

Well we can only provide information as to how converting from http:// to https:// is achieved......at least you are armed with some background knowledge if you need to find someone to do this for you.

I guess whoever does this will need to do a sitewide find and replace - find http:// change to https:// but if you have links to external sites which use http:// you risk getting a message back from the server when those sites are visited, that the site you are visiting is not secure.

I don't know anything about Godaddy web hosting, what they provide in the way of a control panel and even if they have an .htaccess file. If you are using a Mictrosoft hosted server then the procedure is completely different, as it doesst have an htaccess file

Whatever...make sure you have a full-back up of your website before you start messing around with it.

[WolfShade]

I use hostek.com, and they are set up to work with Let's Encrypt, AND they have the right things in place that you can have it set to automatically renew the certificate so you don't have to do ANYTHING every third month.

Very easy.

V/r,

^ _ ^

[osgood_]

WolfShade  wrote

I use hostek.com, and they are set up to work with Let's Encrypt, AND they have the right things in place that you can have it set to automatically renew the certificate so you don't have to do ANYTHING every third month.

Very easy.

V/r,

^ _ ^

Yes, I get an email through saying a new certificate has been issued automatically or have been so far.........fingers crossed

[WolfShade]

osgood_  wrote

Yes, I get an email through saying a new certificate has been issued automatically or have been so far.........fingers crossed

You get an email?  Is there a setting, for that?  I don't get an email.

V/r,

^ _ ^

[larry45]

Thanks, I get two versions. One is total nightmare where thousands of my new SSL pages will have broken padlocks because many of the elements are not SSL well yet, and worse the hundreds of current search results all need thousands of manual redirects, and come up 404 until that is done -- losing biz.

But my old SEO consultant I spoke with today said he can do this simply with his developer-- automated in which everything easily should come out roses as Osgood is implying.

(I've been scared my an article I read -- few years old, suggesting the former situation)

[osgood_]

larry4545  wrote

Thanks, I get two versions. One is total nightmare where thousands of my new SSL pages will have broken padlocks because many of the elements are not SSL well yet, and worse the hundreds of current search results all need thousands of manual redirects, and come up 404 until that is done -- losing biz.

But my old SEO consultant I spoke with today said he can do this simply with his developer-- automated in which everything easily should come out roses as Osgood is implying.

(I've been scared my an article I read -- few years old, suggesting the former situation)

You sound like I sounded a few months back, had zero idea of what I was doing or what it was all about.

It turned out to be fairly simple in the end but I dont have thousands of pages so I guess that could be a bit daunting but as I say if you back your site up an do a sitewide find and repalce that should account for a lot of the work you will need to do.

Most credible sites these days will have already converted and have been using https:// for a long time so if you do have external links to them it should not be an issue, its your own internal links you need to update.

Godaddy must be able to provide a service which can update your hosting to use a secure connection.

I dont thnk you should worry too much about Google - none of the sites I converted so far have suffered from it, they are still highly ranked and now listed as https:// rather than http://

[WolfShade]

For future projects, if you're not developing in https://, then use relative paths for everything local, then use protocol agnostic links for external sites (ie, instead of "http://www.anothersite.com/aboutus/index.htm", remove the "http:" and use "//www.anothersite.com/aboutus/index.htm") so that you don't have to add the "s".  Links that begin with "//" automatically use the protocol that the page is using.

V/r,

^ _ ^

[larry45]

Thanks Wolf, maybe understood 10% of your post.

Once this nightmare is over:... then when I make new pages in DW are those S? ....

Limitations of talking through a computer.

[WolfShade]

http and https are protocols - unencrypted and encrypted, respectively.  What I mean by "protocol agnostic" is that when you use protocol agnostic links, the browser will automatically use whichever protocol the page is loading through.  So, if you develop in unencrypted, but your production is encrypted, you don't have to "hard code" the protocol into the links - the browser will use the protocol for those links that the browser is using.  So, if all of your external hyperlinks (links to any domain outside of yours) begin with slash-slash (//), and the browser is in http, those links will be in http.  If the browser is in https (SSL or TLS secured), then the external links will use https.  That way, you can write code for both without having to change http to https when pushing to production.

HTH,

^ _ ^

[osgood_]

WolfShade  wrote

osgood_   wrote

Yes, I get an email through saying a new certificate has been issued automatically or have been so far.........fingers crossed

You get an email?  Is there a setting, for that?  I don't get an email.

V/r,

^ _ ^

I don't use hosetek but another hosting company who appear to send emails, Ive only had a couple to date as I've only just started converting my clients sites over to https:// but I expect t get more over the coming weeks, depending on where the certificate is in its life cycle.

[Nancy OShea]

This link below will get you started with SSL Certs on GoDaddy hosting.  Domain validation is probably all you need.

SSL Certificate | Secure Your Data & Transactions - GoDaddy

[larry45]

Thanks Nancy none of this help. My site has thousands of inner pages and and sub wordpress sites, blog.. And I just go off the phone with someone in the biz and he says, even after the SSL. many of pages with have 1/2 a palock and elements may need to be fixed, and worse, the hundreds of search hundred of results will get 404s. Total nightmare. Is there any consultant service that can help?

[osgood_]

larry4545  wrote

and worse, the hundreds of search hundred of results will get 404s. Total nightmare. Is there any consultant service that can

That should not happen as any search list which still has the old http:// listed will get automatically directed to the new https:// url assuming you use the re-write code in the htaccess file. Google will eventually update itself to include https://........so it should not effect your listing position or popularity

[Nancy OShea]

I think you're making more of this than it is.   Mixed content (http & https) is something every web site has to contend with when they first get SSL certs.   You will sort it out eventually.   You can also let Google know what your preferred url  is (HTTPS with or without WWW) via your webmaster tools console. 

[Nancy OShea]

larry4545  wrote

What service did you use?

I used NameCheap.com and purchased a 1 year Comodo SSL.  The price was reasonable and their knowledgeable was extremely helpful.

https://www.namecheap.com/support/knowledgebase/category.aspx/14/ssl-certificates

Important: Decide how many domains you need to cover with SSL.  For example,  mysite.com, www.mysite.com, login.mysite.com, mail.mysite.com, etc...  You would probably want to get a Multi-Domain or Wildcard Certificate to cover all.

https://www.namecheap.com/security/ssl-certificates.aspx

[larry45]

www.mysite.com, login.mysite.com, mail.mysite.com, etc...

Oh no! Another thing..

Never heard of that before. make note; never end. My big worry is the 2000 search results that come up and not getting 404s

[Nancy OShea]

larry4545  wrote

My big worry is the 2000 search results that come up and not getting 404s

Stop worrying.  After your certificate is installed and activated, your web pages reside on both http and https.  So there will be no 404 errors from SERPs unless you actually delete files from your server. 

When you redirect all incoming traffic from HTTP to HTTPS with your .htaccess file, it will be ttoally seamless.   As an example, go to my website (alt-web.com) type HTTP:// in the address bar.   It resolves automatically to HTTPS://

[larry45]

Thanks Nancy that is comforting. My site had thousand inner files, and also now 6 wordpress subsites inside.

I got a walk up call, because in reverse, I got rid of a site that had SSL on in and did a redirect to my current main site that does not. But whien I click on bookmarks for it one gets "non secure site page"..  Godaddy, says I now have to put SSL on that site and do a force redirect. Not had time yet.

A consultant has said to me  " I've read about sites that lost half their organic traffic for months, although I haven't seen that happen myself "