how to use HTTPS with mybb about docs.mybb.com HOT 9 CLOSED

This should also cover:

• TLS setup, cipher suites basics & recommendations (best if outsourced),
• securing the connection between reverse proxies and the forum server (if applicable),
• security headers mentioned in https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#tab=Headers,
• Subresource Integrity,
• DNSSEC,
• monitoring CSP violations with e.g. https://report-uri.io/,
• manual debugging and fixing insecure resources,
• overview of how DVZ Secure Content works and what to expect from it.

It should include some brief theory with links to verified sources for further reading and implementation instructions with examples. A link to the support section on the Community forums wouldn't hurt either, should any problems arise or somebody would like their setup to be verified.

from docs.mybb.com.

so better suited to be written by a developer, @devilshakerz? 😬

from docs.mybb.com.

ciphers...

Mozilla: https://mozilla.github.io/server-side-tls/ssl-config-generator/
Cipherli.st: https://cipherli.st/

from docs.mybb.com.

some other useful resources that could be included...
http header check: https://securityheaders.io/
http hardening tips: https://scotthelme.co.uk/hardening-your-http-response-headers/
obtaining let's encrypt certs with nginx & ubuntu 14.04: https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04
obtaining let's encrypt certs with apache & ubuntu 14.04: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04
SSL config testing tool: https://www.ssllabs.com/ssltest/

from docs.mybb.com.

5d4d90b

from docs.mybb.com.

My thunder has been stolen! I'll find a way to work some of my more thorough detail into some of these sections at some point to make it a bit more comprehensive.

from docs.mybb.com.

mybb/mybb#2464 will have to be mentioned too once it's merged.

from docs.mybb.com.

I think this can probably be closed now, yes?

@devilshakerz, @JoshHarmon

from docs.mybb.com.

I've outsourced the certificate installation guide to Digicert and Namecheap pages but anyone can feel free to push/PR additional information if it's not mentioned on reputable websites.

from docs.mybb.com.