#357 Adding SSL pro

Wow Ryan! That was some fast turnaround! I only emailed you a couple of days back on this request.

Just adding a bit more.

I really wanted to keep my HTTP server block configuration DRY for nginx.

You can keep the HTTP and HTTPS server block in nginx configuration the same by simply adding a listen for port 80 and port 443 in the same block. Further you can add the ssl options in that same block as well. All you need to change is the X-Forwarded-Proto to be set to $scheme instead of http or https.

Why not use something like Powder to manage your Pow projects?

Great episode, as usual. This one and the previous are particularly useful as so many people just don't pay enough attention to these issues.

I usually prefer forcing https with nginx directly, though, rather than in the application; it's simpler, somewhat "lighter" and I don't need to have to worry about this being properly configured and tested in the app. It's more like set it and forget it.

E.g. I usually have two "server" blocks, one for http and the other with https enabled, and the http block only contains:

`rewrite ^(.*) https://$server_name$1 permanent;`

Besides, I don't think it's a good idea either to only force SSL for some sections of an application: cookies travel with all http requests, regardless of whether https is in use or not. In theory if there is even a single thing on a site that requires authentication, the whole app should run under https, not only some sections for this very reason. I blogged about this not long ago.

A couple tips:

1. there's a gem called powder that makes it easier/nicer to work with Pow.

2. I can't remember whether it was this episode or the previous one that suggested to hardcode 'https' in links and refs to images when needed. Something like:

image_tag "https://...."

You can also just omit the protocol altogether - this will make sure that all the resources loaded / linked on the page "follow" the protocol used by the page itself, i.e.:

image_tag "//...."

This way all images etc will use http or https depending on the protocol used by the page itself.

Hi everyone

I buy ssl certificate from Network Solution. They gave four files

• AddTrustExternalCARoot.crt
• NetworkSolutions_CA.crt
• UTNAddTrustServer_CA.crt
• WWW.EXAMPLE.COM.crt

Can you guys please help me, how can i install or setup SSL to my rails app to run https://example.com by step-by-step. :)

Important: I am using heroku and i add the ssl endpoint add-on.

i am using ubuntu 11.04 OS.

Thanks

Awesome screencast, as always, and timely considering the recent LinkedIn and eHarmony hacks -- we should all use these instances as a reminder to get secure and locked down!

If you're using AWS (EC2) for hosting, there's a very interesting option using their elastic load balancer (ELB): install your certificate there and configure traffic on port 443 to be sent to an instance via port 80. This simplifies configuration in a lot of cases because you don't need to mess with Apache or Nginx or set up keys for each of your servers, and locally everything can run on simple HTTP.

There are a couple of cases where things can get tricky, but for our use-case, this method is working beautifully.

By the way, just because you have a load balancer doesn't mean you need to have more than one server, which is great for staging and other environments.

Just got myself two certificates on GoDaddy for $12.99 each; just wherever you get yours, first search on sites like RetailMeNot.com for coupons and stuff. Those godaddy certs were a whopping $70 a year before the coupons.

ssl_protocols SSLv2 SSLv3 TLSv1;

Ryan, are you sure about SSLv2? It's pretty unsecured protocol.
I spent a time on Nginx security and would like to share my config

    ssl_protocols             SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers               RC4:HIGH:!aNULL:!MD5;
    add_header                Strict-Transport-Security "max-age=16070400; includeSubdomains";
    add_header                X-Frame-Options DENY;

To enable TLS 1.1/1.2 protocols you need to compile Nginx with openssl > 1.0.x.
Some useful headers can help with interaction through HTTPS only (from all feature requests) and prevent an option to load your site into iframe.

  $ wget http://www.openssl.org/source/openssl-1.0.1c.tar.gz
  $ tar xzvf openssl-1.0.1c.tar.gz && rm -f openssl-1.0.1c.tar.gz
  $ configure --with-openssl-opt=no-krb5 --with-openssl=/usr/src/openssl-1.0.1c

No-krb5 to disable Kerberos 5 authentication protocol which causes Nginx segfaults by Internet Explorer request (rarely bug)

Qualys SSL test can help in the search for vulnerabilities in web-server configuration.

for non-heroku users: If you want to get an access all-site through HTTPS-only what is the reason to handle SSL detection through Rack and ActionDispatch? All that code can be simplified by using redirection through web-server 301 permanent redirect.

server {
    listen       80;
    server_name  host.com *.host.com;
    rewrite ^(.*) https://$host$1 permanent;

    access_log /dev/null;
    error_log /dev/null;
}

A specific header Strict-Transport-Security tells the browser that all future requests (and cookies as well) should go through SSL only. Don't use SSL for partly access, because cookies can be hacked while you are non-SSL page.

Don't forget about scaling patterns such as SSL offload, so every application servers should not used an SSL, but edge load balancers only. So permanent redirection on web-server side only (not application) can help with scaling without any modifications of Rails codebase.

Thanks for the great screencast, but I'm not sure why you write off StartSSL as "isn't for serious use". StartSSL uses all the same algorithms as the bigger providers and even uses better ones in certain cases (eg. connections will default to 256-bit instead of the usual 128-bit), plus they enforce better security practices than most providers (eg. you must use an SSL client certificate to login, there's no username/password).

To top it off, the free certificates are even insured for up to $10,000 in damages, with paid ones providing more insurance.

Thanks again for the very useful screencast, but you should do a bit more research before saying something "isn't for serious use", as your opinion carries much weight for many individuals. :-)

Got mine from Cheap SSLs. I'm using Apache because the Ubuntu installations I've worked with have already had it ore-installed. My app is Rails 3.2 so all I did was put a config.force_ssl = true into my production.rb file.

You override the https requirement for all the actions in a controller with:

private
def use_https?
false
end

How would you do it on an single action or a subset of all the actions in a controller?

Thanks

How do assets to work with https and http?

Does this setup with pow and nginx interfere with mongoid?

I get a routing error with "uninitialized constant Model::Mongoid" when I use a Mongoid model.

The only thing I can think of is that the proxy some how gets in the way.

Has any one else experienced this?

Ryan,

Did you know about (or borrow from) this?

https://github.com/yardstick/ssl_requirement

I tried install with mac port, but conf verification failed with this error,

nginx: [emerg] unknown directive "ssl" in /opt/local/etc/nginx/nginx.conf:102

Found out that should install nginx with ssl option, it is not there by default

sudo port install nginx +ssl

Thank you so much. This really helped me out. So glad you made this podcast. :)

If you have a problem with assets not showing make sure you remove the "http://" from this line:

config.action_controller.asset_host = "http://" + config.domain

Hi Ryan,

I am using this pattern to do the appropriate redirects to http if my controller and action doesn't need to be secure.

However, I am hitting this error - Filter chain halted as :https_redirect rendered or redirected

I am using apache and seems like something fairly basic I am missing.

...
...
ServerName XXXX
ProxyRequests Off
ProxyPreserveHost On
ProxyPassReverse / http://www.XXX.com/

RewriteEngine On
RewriteRule ^(.*) - [E=CLIENT_IP:%{REMOTE_ADDR},L]
RequestHeader set X-Forwarded-For %{CLIENT_IP}e
RequestHeader set X-Forwarded-Proto "https"

if i disable the filter, https works just fine.

any pointers on what may be wrong?

thanks

I am using windows on my development machine ,,,any one having experience on adding ssl while developing on windows ,,please help me ..thanks

My nginx.conf is OK and nginx seems to start but my https URL in Google Chrome gives me an this error:

SSL connection error
Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.

When I do a lsof -i:443 I see this:

COMMAND     PID   USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
apsd         71   root    9u  IPv4 0xcb28d77b1a14342f      0t0  TCP 10.0.1.32:54135->17.172.232.214:https (ESTABLISHED)
nginx     11899   root    6u  IPv4 0xcb28d77b188cb1a7      0t0  TCP *:https (LISTEN)
nginx     11900 nobody    6u  IPv4 0xcb28d77b188cb1a7      0t0  TCP *:https (LISTEN)
Google    68100    Aen   43u  IPv4 0xcb28d77b16b478df      0t0  TCP 10.0.1.32:54191->ni-in-f125.1e100.net:https (ESTABLISHED)
Google    71302    Aen  155u  IPv4 0xcb28d77b1b2201a7      0t0  TCP 10.0.1.32:55087->sin04s01-in-f30.1e100.net:https (ESTABLISHED)
Google    71302    Aen  173u  IPv4 0xcb28d77b1b236017      0t0  TCP 10.0.1.32:55065->ni-in-f147.1e100.net:https (ESTABLISHED)
Google    71302    Aen  185u  IPv4 0xcb28d77b175de42f      0t0  TCP 10.0.1.32:55123->github.com:https (ESTABLISHED)
Google    71302    Aen  194u  IPv4 0xcb28d77b1b23b74f      0t0  TCP 10.0.1.32:55127->ec2-204-236-241-186.compute-1.amazonaws.com:https (ESTABLISHED)
Google    71302    Aen  217u  IPv4 0xcb28d77b1b1d88df      0t0  TCP 10.0.1.32:54361->sin01s05-in-f2.1e100.net:https (ESTABLISHED)
Google    71302    Aen  260u  IPv4 0xcb28d77b1b245017      0t0  TCP 10.0.1.32:55078->a23-15-10-57.deploy.akamaitechnologies.com:https (ESTABLISHED)
Dropbox   95185    Aen   18u  IPv4 0xcb28d77b1b240017      0t0  TCP 10.0.1.32:55130->108.160.160.177:https (CLOSE_WAIT)

Do I have other crap listening on 443?

I had a few issues with installing pow that I was finally able to resolve. My biggest issue was that apache was running so whenever it redirected, I would get the "It Works!" screen. Then the only way I could redirect was to go to http://myapp.dev:3000 (clearly not what I wanted!)
By stopping apache and preventing it from starting up I was able to get pow running. Took a while, so hopefully that will help someone else out.

I have documented How to Install Alpha SSL certificate using Moonshine for Rails 4.1

This might be helpful if you get a rvm error with pow.
http://stackoverflow.com/questions/20199970/bundlerrubyversionmismatch-your-ruby-version-is-1-9-3-but-your-gemfile-speci

HI

http://binaryhash.wordpress.com/2014/06/20/how-to-setup-secured-ssl-on-nginx/

I posted one SSL setup with nginx

May it will be helpful

if any question you ask me

Looks like NGINX is no longer free. Anyone know of any other options?