I've been putting this off since Google announced it back in February, and I kept putting it off right up until it stopped being a someday project and became a this-month project. Chrome 68 ships later in July, and once it does, every plain HTTP page gets a "Not Secure" label sitting right in the address bar, in plain red-adjacent text, for anyone who visits. Techpad has been running on and off since November 2011 and for most of that time nobody cared whether a personal blog had a padlock or not. That's over now. So I spent Tuesday night moving this whole site to HTTPS, half paying attention to the France-Belgium semifinal in the background (1-0, not exactly a classic, but I'll take it since it means an actual final on Sunday).
If you've never done this before, here's roughly what it looks like in mid-2018, assuming you're running your own box instead of paying Squarespace or whoever to handle it for you.
Skip the paid certificate. This is the part that annoys me most in retrospect, because for years the going advice was to buy a certificate from somewhere like GoDaddy or DigiCert, and those things run anywhere from $10 a year for the cheap ones up to $70+ if you wanted anything with a green bar. Let's Encrypt has been issuing free, browser-trusted certificates since 2016, and by now it's genuinely the default answer. Free. Automated. No excuse left.
Install certbot. On my Ubuntu box this was:
sudo apt-get update
sudo apt-get install python-certbot-nginx
There's a certbot package for basically every distro and every major web server at this point, which is the one thing about this whole process that actually went smoothly for once.
Run it and let it edit your config.
sudo certbot --nginx -d techpad.example -d www.techpad.example
It asks you a couple of questions, one of which is whether you want to force a redirect from HTTP to HTTPS. Say yes. There's no reason to leave the old door open once the new one works, and half the point of doing this at all is making sure Chrome sees HTTPS on every single request, not just some of them.
Set up the renewal. Let's Encrypt certs are only good for 90 days, which sounds annoying until you realize it's actually the best part of the whole system, because it forces automation instead of relying on someone remembering to renew a cert once a year and inevitably forgetting (I did this exactly once with an old job's site and the outage lasted a full weekend before anyone noticed). Certbot drops a cron job in automatically. I checked mine was actually there with:
sudo certbot renew --dry-run
and it passed, so I'm trusting it.
After all that, I ran the site through Qualys SSL Labs' test just to see the report card, and got an A. Not an A+, apparently because of some cipher suite thing I didn't feel like chasing down at eleven at night, but an A is fine for a blog about, checks notes, myself.
The bigger annoyance in all of this isn't the technical part, it's that I now have to go back through eight years of old posts and fix a bunch of hardcoded http:// image links and embeds that'll otherwise throw mixed-content warnings once the padlock shows up. I'm doing that in batches instead of all at once because there are a genuinely embarrassing number of old posts on here and I don't want to spend my whole week on it.
If you're running any kind of personal site right now and you haven't done this yet, do it this week rather than the week Chrome 68 actually rolls out. Waiting until people start seeing warnings on your links is the wrong order to do things in.