WebPerf SSL Stack Overflow Switches to HTTPS Default

eva2000 · May 25, 2017

Stack Overflow properties officially switch over to HTTPS default and they have a write up on the process in detail Nick Craver - HTTPS on Stack Overflow: The End of a Long Road

Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The activation of this is quite literally flipping a switch (feature flag), but getting to that point has taken years of work. As of now, HTTPS is the default on all Q&A websites.

We’ve been rolling it out across the Stack Exchange network for the past 2 months. Stack Overflow is the last site, and by far the largest. This is a huge milestone for us, but by no means the end. There’s still more work to do, which we’ll get to. But the end is finally in sight, hooray!

Fair warning: This is the story of a long journey. Very long. As indicated by your scroll bar being very tiny right now. While Stack Exchange/Overflow is not unique in the problems we faced along the way, the combination of problems is fairly rare. I hope you find some details of our trials, tribulations, mistakes, victories, and even some open source projects that resulted along the way to be helpful. It’s hard to structure such an intricate dependency chain into a chronological post, so I’ll break this up by topic: infrastructure, application code, mistakes, etc.
Click to expand...

eva2000 · May 25, 2017

one reason I use SSL Wildcard certificates as well Nick Craver - HTTPS on Stack Overflow: The End of a Long Road

HTTP/2 has a lot of performance benefits, especially with pushing resources opportunistically to the user ahead of asking for them. I won’t write in detail about those benefits, Ilya Grigorik has done a fantastic job of that already. As a quick overview, the largest optimizations (for us) include:

Request/Response Multiplexing

Server Push

Header Compression

Stream Prioritization

Fewer Origin Connections

Hey wait a minute, what about that silly certificate?

A lesser-known feature of HTTP/2 is that you can push content not on the same domain, as long as certain criteria are met:

The origins resolve to the same server IP address.

The origins are covered by the same TLS certificate (bingo!)

Click to expand...

eva2000 · May 25, 2017

ooh DNSControl tool born

GitHub - StackExchange/dnscontrol: Synchronize your DNS to multiple providers from a simple DSL

Introducing DnsControl – “DNS as Code” has Arrived - Server Fault Blog

Global DNS
When moving from Cloudflare to Fastly, we had to evaluate and deploy new (to us) global DNS providers. That in itself in an entirely different post, one that’s been written by Mark Henderson. Along the way, we were also controlling:

Our own DNS servers (still up as a fall back)

Name.com servers (for redirects not needing HTTPS)

Cloudflare DNS

Route 53 DNS

Google DNS

Azure DNS

…and several others (for testing)

This was a whole project in itself. We had to come up with means to do this efficiently, and so DNSControl was born. This is now an open source project, available on GitHub, written in Go. In short: we push a change in the JavaScript config to git, and it’s deployed worldwide in under a minute.
Click to expand...

eva2000 · May 26, 2017

touched on dangers of HSTS enabling here Nginx Vhost & NSD DNS Setup - CentminMod.com LEMP Nginx web stack for CentOS

for stackoverflow Nick Craver - HTTPS on Stack Overflow: The End of a Long Road

There’s one more critical piece of archaeology here: our internal domain is ds.stackexchange.com. Why ds.? I’m not sure. My assumption is we didn’t know how to spell data center. This means includeSubDomains automatically includes every internal endpoint. Now, most of our things are https:// already, but making everything need HTTPS for even development from the first moment internally will cause some issues and delays. It’s not that we wouldn’t want https:// everywhere inside, but that’s an entire project (mainly around certificate distribution and maintenance, as well as multi-level certificates) that you really don’t want coupled. Why not just change the internal domain? Because we don’t have a few spare months for a lateral move. It requires a lot of time and coordination to do a move like that.

For the moment, I will be ramping up the HSTS max-age duration slowly to 2 years across all Q&A sites without includeSubDomains. I’m actually going to remove this setting from the code until needed, since it’s so dangerous. Once we get all Q&A site header durations ramped up, I think we can work with Google to add them to the HSTS list without includeSubDomains, at least as a start. You can see on the current list that this does happen in rare circumstances. I hope they’ll agree for securing Stack Overflow.
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

WebPerf SSL Stack Overflow Switches to HTTPS Default

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

WebPerf SSL Stack Overflow Switches to HTTPS Default

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.