Posts tagged with 'certificate'


Making an AWS static website EVEN MORE secure

OK, so we have a secure website, hosted on Amazon S3, and served up via HTTPS by CloudFront with an Amazon SSL Certificate. But, as we know from last time, we also have to express this security through our response headers. It was fairly easy with Azure – after all, it’s “just” IIS back there, and web.config is the answer to everything once you know the magic incantations – but how to do the same thing on AWS? For this one, I am indebted to an official Amazon blog post: Adding HTTP Security Headers...

READ MORE

Making an AWS static website secure

So there I was, patting myself on the back for making an Azure static website secure (with all the right headers , natch), when I gave myself a quick nod: yep, let’s do the same for this other static website, one that’s hosted on Amazon S3. Morceau de gâteau ! Please, please, please, can I go back in time to stop myself? What a lengthy ordeal, a flippin’ slog. Sisyphus had it easy. Let’s enumerate what you should do, in the right order (rather, than what I did, which was all messed up). Get your...

READ MORE

Making an Azure static website EVEN MORE secure

Remember how I was congratulating myself that I’d made my jmbucknall.com static website, that is hosted on Azure, secure? How I’d bought and uploaded an SSL certificate, and made the site only accessible via HTTPS? Well, HA! I say that, because Barry Dorrans (self-described as “Microsoft's .NET security person”) was ‘kind’ enough to point out that I hadn’t really finished the job. I hadn’t added the proper “security headers” (WTF are they?) via a web.config (wut? it’s a static site!) and that I should...

READ MORE

Making an Azure static website secure

One thing that’s been niggling at the back of my mind for a little while, is that of making my various domains secure. Getting and installing a certificate. Making HTTPS the default. Using SSL. All that jazz, mostly triggered by the news that Chrome and Firefox are going to start shaming – er, sorry, indicating in the address bar – those sites that are not secure. But, OK, I admit it, all the stuff I’ve read just seems to point out how deeply involved it all is, how expensive, and so on. This ain...

READ MORE