Update: The network move has started, you can follow here: Network-wide HTTPS: It's time
This is a heads up, and a request for help.
HTTPS for our entire network is long overdue, but we've been working hard on it behind the scenes. Expect a pretty big blog post when we turn it on everywhere that details the journey.
There are a few lingering questions on HTTPS we're not confident in until we do it live. One of these is the Google site move in webmasters. It still (to our disbelief) treats HTTP and HTTPS as different properties. I have no idea why. And the "change of address" tool doesn't support such a move either:
Note: The tool does not currently support the following kinds of site moves: subdomain name changes, protocol changes (from HTTP to HTTPS), or path-only changes.
So we'll have to create property sets for every single site during the move to HTTPS. Fun!
Given the above, we need to see how all of this works in practice with real load:
We're starting with meta.stackoverflow.com and meta.stackexchange.com.
Here's an order of things that's been going on:
- done Infrastructure in place:
- A fast CDN/Proxy for local termination (Fastly)
- Certificates (including IP pooling support to bridge HTTP/1.1 & HTTP/2)
- Logging
- done Get third-party support in place:
- All per-site scripts onto our CDN and served securely
- Ad providers to HTTPS
- done Fix a ton of code that assumes
http://
in a million places. - done Prevent users from embedding new
http://
content (e.g. forcing HTTPS images). - done Cleanup all existing user content that was
http://
(https://
where possible, and converted to links if we can't embed it securely). - done Make sites render absolute URLs as
https://
. - done Move canonical URLs to
https://
. - done 302 Traffic to
https://
for search engines. - done 301 Traffic to
https://
for search engines. - done 301 Traffic to
https://
for all. - done (Child metas) Move from
meta.*.stackexchange.com
to*.meta.stackexchange.com
. - Force all Q&A traffic to
https://
(and set an https-only cookie) - Migrate all existing sessions to secure sessions (this will take time to run).
- Use HSTS to ensure browsers don't hit Q&A sites via
http://
at all.
This is a really high level list, there are a crazy number of nuances and edge cases to the above. This is for Q&A. Area 51, Chat, and stackexchange.com (the main site) have a separate set of concerns and code we'll address after Q&A. The list also isn't necessarily in order. While we're testing #6, Samo and I will be working on #11 at the same time.
We want your help simply reporting any issues here with insecure content on https://
or any other oddities you see. We'll try to address them as soon as possible.
<kbd>
castle question works ok and without edge cases. Everything else can wait. Checking now. (Edit: all is well.)*.meta.stackexchange.com
I'm going to be struggling with this for quite some time, I fear...