Move site away from StartSSL certificate about parf-edhellen HOT 8 CLOSED

@galadhremmin Fantastic result on SSLTest, too, other than a currently-minor quibble about DNS CAA: No, which you'd hafta take up w/ Lightsail, if you choose.

Congrats!

from parf-edhellen.

Hi @TPS! Thank you for informing me about this issue. I just learned about this myself today through the podcast Security Now. I will be looking into changing the certificate next week.

from parf-edhellen.

ElfDict's host doesn't seem to support Let's Encrypt. I've sent a message to my host, asking if it's possible to implement this in the future. I can't manually generate certificates for ElfDict as their life time is only 90 days.

from parf-edhellen.

I've fixed it by transitioning to Amazon Lightsail! Thank you for the feedback @TPS !

from parf-edhellen.

It turns out that you may not have to, because of updates in the last ~48 hours.… I'm sure SG will be covering it soon, but the latest is that StartSSL is reorganizing under different ownership in hopes of saving the brand. Iff the implemented changes are acceptable to the security community (a _HUGE_ iff), they'll invalidate all old certs & reissue new 1s under the new secure architecture. For now, it may be sufficient for you just to drop the cert/HSTS & go HTTP for a little bit, while waiting for a new cert.

from parf-edhellen.

Also, does something like Netlify work for you?

from parf-edhellen.

My host is working with Symantic to implement a similar solution (https://www.symantec.com/theme/encryption-everywhere) but it won't be ready until next year. So in light of this, I've generated a 90-day certificate using Let's Encrypt, and working on convincing my host to install it for my site. The discussions are still ongoing.

from parf-edhellen.

@TPS I reached out to FSData which still manages my domain names, and their DNS unfortunately does not support this feature yet. I'll see what I can do.

from parf-edhellen.