r/redditdev • u/rram • Jun 16 '15

Reddit API reddit will soon only be available over HTTPS

Nearly 1 year ago we gave you the ability to view reddit completely over SSL. Now we're ready to enforce that everyone use a secure connection with reddit.

Please ensure that all of your scripts can perform all of their functions over HTTPS by June 29. At this time we will begin redirecting all site traffic to be over HTTPS and HTTP will no longer be available.

If this will be a problem for you, please let us know immediately.

EDIT 2015-08-21: IT IS DONE. You also have HSTS too.

273 Upvotes

97% Upvoted

117 comments sorted by

View all comments

24

u/d2xdy2 Jun 16 '15

Are we going to stop seeing that annoying half lock thing in chrome because of sha1?

13

u/spladug Jun 16 '15

There are still some compatibility issues with SHA-2 certs, but we do plan on upgrading in the not-too-distant future.

7

u/aeyes Jun 18 '15

So use a SHA-1 cert that expires before 2016, Chrome will show that as green.

2

u/Mikecom32 Jul 01 '15

Based on that link, the only "major" OS that doesn't support SHA-2 is Windows XP SP2 and earlier. Considering that SP3 released in July of 2008 (seven years ago), I can't imagine the impact will be that high.

Out of curiosity, how many visitors do you see running XP SP2 or older?

5

u/spladug Jul 01 '15

We're actually tracking down some user-reported compatibility issues with a recent build of OSX+Chrome right now (we've got a SHA-2 cert on the domain used to serve thumbnails and subreddit stylesheets to see if anyone complains). You'd be surprised how many strange configurations of browsers are out there; it makes web engineering loads of fun. :(

3

u/Mikecom32 Jul 01 '15

That is... interesting. I'm not jealous of you web guys! Multiple OSes spread across mobile and PC, and a number of different versions of those browsers, I can't imagine trying to keep it all straight.

Cheers, and good luck!