Make http://citationstyles.org/ and subdomains HTTPS

[adam3smith]

https://blog.cloudflare.com/secure-and-fast-github-pages-with-cloudflare/

Who has control over the registration (which is needed for this)? Is that still at CHNM?

[rmzelle]

There are indications that GitHub is (finally!) starting to slowly roll out HTTPS support for custom domains, so I would just wait and not bother with the Cloudflare hack. See isaacs/github#156 (comment) for recent progress on this issue.

For http://docs.citationstyles.org/ we're dependent on hosting by https://readthedocs.org/, so that's a separate issue, see readthedocs/readthedocs.org#2652 (comment).

(P.S. https://discourse.citationstyles.org/ is also already HTTPS)

[rmzelle]

Some good news already: I was able to enable "Enforce HTTPS" for https://formatter.citationstyles.org/ and https://validator.citationstyles.org/, which are now served over HTTPS. Per the issue linked above, it looks like GitHub is a little further along with third-level hostnames like https://formatter.citationstyles.org/ than with second-level hostnames like http://citationstyles.org/ (isaacs/github#156 (comment)). Can't enable HTTPS for http://citationstyles.org/ yet.

[jayvdb]

You may want to try https://netlify.com which provides this feature already, and more.

[rmzelle]

You may want to try https://netlify.com which provides this feature already, and more.

I rather not, especially since GitHub seems to be finally rolling this out, probably driven by Google's decision to mark all HTTP sites as non-secure by July 2018: https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html. I assume we'll get native HTTPS support for GitHub Pages if we just wait another month or two.

[rmzelle]

Earlier today GitHub enabled HTTPS for all custom domains, so we've just activated it for https://citationstyles.org/. Dan Stillman from Zotero kindly updated the A record (domain is still at CHNM), and I had to fix a small mixed content issue with our theme (solved by specifying the HTTPS domain in _config.yml per mmistakes/minimal-mistakes#1318 (comment)), but everything seems to work now. I enabled "Enforce HTTPS".

So the only remaining HTTP part is http://docs.citationstyles.org/, which needs a change at Read the Docs (as I wrote above at #37 (comment)).

[rmzelle]

Created a separate issue for http://docs.citationstyles.org/. Since the rest is HTTPS now, closing this.