Puffin/Aegir SSL options

[jim]

Per other tickets, SSL setup certs now work (see ticket:478#comment:15), the actual secure redirects within Drupal are still to do. This is a blocker for now...

See:

1. Backgound: ​Do I need an extra IP address in order to deploy an ssl certificate?
2. More: ​Auto Forward to https with BOA
3. Best option?: ​Use extra config with new "/data/conf/override.global.inc/" file
4. (SLOW) Drupal module: ​Carry on using 443 Session

What do you think is best, Chris? My vote is for 3, with 4 as backup...

[chris]

Replying to jim:

3. Best option?: ​Use extra config with new "/data/conf/override.global.inc/" file
4. (SLOW) Drupal module: ​Carry on using 443 Session

What do you think is best, Chris? My vote is for 3, with 4 as backup...

3. is simply redirecting some http URLs to https, it won't ensure that all authentication cookies are secure, 4. does what is needed, why do you think it's slow?

[jim]

4 would be slower than the other options because 3) happens when settings.php (and the global.inc, then override.global.inc) are loaded very early in Drupal's bootstrap. 4 needs a module, which requires lots more files to be loaded and run before the relevant hooks are run.

I've added Session 443 back to the platform, and we'll go with that (option 4).

The code required in our tn.org settings.php looks like this:

# chris
# https://www.transitionnetwork.org/admin/help/session443
  if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
    ini_set('session.cookie_secure', 1);
  }

Which is simple, but I see this commit referring to issues with Drupal e-commmerce stuff: ​http://drupalcode.org/project/barracuda.git/commit/dfa3536 -- not a problem now, but when the Transition Network shop opens we would need to have a better alternative.

Since ticket:487#comment:2 needs me to add some code to override.global.inc, I can probably add this at the same time.

[chris]

Replying to jim:

I've added Session 443 back to the platform

Thanks, the secure flag does need setting on the authentication cookie.

[jim]

Replying to chris:

I've added Session 443 back to the platform

Thanks, the secure flag does need setting on the authentication cookie.

Per ticket:487#comment:3, I've now set this for all our sites on all platforms via /data/conf/override.global.php

[jim]

SSL works now...

• Cert is correct
• Redirects to HTTPS in login/logged in and other important pages
• Works like current site as far as my tests show: forces HTTPS when logged in, and not when not.

Note due to way settings.php is set up, the warning on Drupal's status page shows despite my work over on #487:

443 Session settings.php
Settings.php is not setup correctly. With the current configuration of 443 Session module, the following lines must be in settings.php.

if (!empty($_SERVERHTTPS?) && $_SERVERHTTPS? != 'off') {

ini_set('session.cookie_secure', 1);

}

}

The above is caused by the module dumbly scanning settings.php with a regexp in session443_requirements() in its .install file. I've raised a ​ticket on Drupal.org.

Closing this for now, unless Chris wants to add anything?