As of today, gitorious.org has vastly improved SSL support. You are now free to surf gitorious.org through https only, should you wish to do so. Previously, our SSL support has been restricted to a few select actions, and there has been redirects from https to http.
With today’s deployment, gitorious.org will never redirect you away from https (if it does, report a bug to support@gitorious.org). You will also be forced to use https as long as you’re logged in, and when posting forms (i.e. logging in).
For those of you who maintain your own Gitorious setups, this change is pretty straight forward. The new SSL feature is enabled by default, and can be controlled through the gitorious.yml setting use_ssl. When this setting is set to true, Gitorious will enforce SSL where appropriate. When it is false, Gitorious will actively ensure http.
We will follow up this change by adding HSTS shortly.
In other news, gitorious.org is also available on IPv6, thanks to our awesome hosting partner, Linpro. We’re still having some issues with the backend for git:// and http:// Git access, so for now they are IPv4 only. We are working to resolve this issue.
11 Comments
Great News!
I have just one little note: The Gravatar images are loaded via standard http and thus showing a warning in chrome that this page contains unsecure contents. (gravatar can be used with https using this domain: https://secure.gravatar.com)
Thanks for the heads up, Philip. I’ve just deployed a minor fix to serve secure gravatars :)
When are you going to buy a SSL cert for gitorious.no ?
As .no (and .net and others) is just a shortcut, I don’t think we will. But I have enabled redirects from other tlds to gitorious.org. You’ll still see a warning if entering https://gitorious.no, but you’ll be promptly redirected to https://gitorious.org, which has a valid certificate.
Thanks for the heads up!
If i access this blogin https, it gives me the certificate from wordpress.com. Therefore some warning…
@Markus: We don’t have SSL support for the blog (yet). The blog is hosted at wordpress.com, mainly in order to stay alive even if gitorious.org goes down.
I am not able to view your RSS feed URL. Can you please help me?
i’ve activate the full ssl option, works perfectly :-)
Looks like this blog haven’t got an AAAA record for it’s own. Perhaps this was by intention?
@Jens: This site runs WordPress on wordpress.com, I haven’t been able to find out whether they support IPv6 yet. If anyone knows how this can be done, we’d love to set up the AAAA records for it!
Do the backend git:// and http:// servers have IPv6 enabled yet?