So Chrome 68 rolled out this week (the stable channel started pushing it around the 24th) and now every single plain HTTP page gets a little "Not secure" label sitting right next to the URL. Not just login forms or checkout pages like before. Every page. I clicked over to techpad in a fresh Chrome profile just to see what it looked like and yep, there it was, gray text right where my address bar used to just show the URL and nothing else.
I've been putting off moving this blog to HTTPS for probably two years now. Every time it comes up I tell myself it's a weekend project and then the weekend arrives and I end up doing literally anything else. Mowing the lawn. Reorganizing my record shelf by color instead of artist, which in hindsight was a mistake because now I can never find anything. Anything but touching the nginx config on a server I haven't logged into since March.
Google's been telegraphing this for a while, to be fair. They started with the "Not secure" warning on password and credit card fields back in Chrome 62 last October, and everyone kind of assumed the next step was going to be all HTTP pages eventually, they just didn't say exactly when. Well, now we know. Chrome 68 is the one. And Chrome has something like 60-something percent of the browser market at this point depending on whose numbers you trust, so this isn't some edge case affecting three people on Opera Mini. If your site's on HTTP, most of your visitors are going to see that label now, not just the security-conscious ones who'd notice anyway.
The annoying part isn't really the technical work. Let's Encrypt has made getting a free cert about as painless as it's ever been, certbot handles the renewal cron job for you, and if your host is anything like mine (cheap shared VPS, nothing fancy) it's maybe forty minutes of actual work once you sit down and do it. The annoying part is all the little things that break afterward that you don't think about until they break. Mixed content warnings because some image tag from 2013 is still pointing at an http:// URL. Old embedded YouTube videos using the wrong protocol. A random widget in my sidebar, an old weather thing I honestly forgot was even still there, that apparently only works over HTTP and just quietly stops loading once you flip the switch. I found that one by accident and I'm still not sure if I'm going to fix it or just delete the widget entirely. Probably delete it. I don't think anyone was checking the weather via my blog's sidebar in 2018 anyway.
What actually got me moving on this, more than the Chrome update itself, was just seeing that gray "Not secure" text sitting there next to my own URL like the browser was mildly disappointed in me. It's a small thing but it works exactly the way it's supposed to, psychologically. A padlock icon disappearing is easy to ignore. Text that says "not secure," in a color that's clearly meant to read as a mild warning, is harder to just scroll past. I imagine that's exactly why Google phrased it that way instead of something more neutral like "HTTP" or "unencrypted." Words matter here and they picked words on purpose.
I'll admit part of my hesitation this whole time has just been laziness dressed up as some vague concern about breaking things. This blog doesn't have logins, doesn't take payments, isn't handling anything sensitive. The actual security benefit of HTTPS for a static-ish personal blog like this is honestly pretty marginal, it's mostly the "not secure" label itself and how it looks to visitors that matters at this point, not some meaningful threat model I'm defending against. Which is a little funny when you think about it. The browser vendor changed a label and that did more to get me to actually act than any amount of me reading articles about SSL best practices ever did.
Anyway. Cert's ordered, I'm testing the config on a subdomain first before I flip the main domain over, because I've broken this site enough times over the years doing things "the quick way" that I've learned my lesson at least on this one specific point. If techpad disappears for a few hours sometime this week, that's probably why, and not because I finally lost the fight with my hosting provider's billing system like last November.