Leaflet: Enable and Force HTTPS on the leafletjs.com website

[theel0ja]

HTTPS has been released for Github Pages custom domains:
https://blog.github.com/2018-05-01-github-pages-custom-domains-https/

Geolocation examples are not currently working because the site is using http.

Edit 2018-05-03: added explanation for linked blog post.

[mourner]

Yeah. We should do this eventually, but it's not trivial because GitHub doesn't support HTTPS on its custom-domain websites. We'd need to set up some kind of proxy, e.g. with CloudFlare.

[ghybs]

Hi @mourner,

Actually if I understand correctly the blog post linked by @theel0ja, GitHub just added support of HTTPS for custom domains, hence the reason why @theel0ja opened this Feature Request?

[mourner]

Damn, apparently I had a case of selective blindness. Sorry! Yes, we should definitely do this now. @JasonSanford the blog says the DNS config should be updated with new IPs, can you take a quick look?

[theel0ja]

@ghybs Yes, I sent the feature request because Github added HTTPS support for custom domains.

[JasonSanford]

I just updated the A records to point to

185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153

The previous TTL was 30 minutes so hopefully soon we'll be hitting the new IP addresses, then we can ✅ it hopefully.

[mourner]

@JasonSanford thanks a lot Jason!

Hmm, I'm seeing leafletjs.com resolving to the new IP addresses, but the browsers still say "Not secure". Here are details from Safari for example:

No idea how to resolve this — I'm really bad at security stuff. Any clues?

[mourner]

Let me try something now...

[mourner]

I removed and re-added the domain as stated here but it's still not working. Let's maybe wait a few hours and see if the issue is resolved, otherwise we'll have to contact GitHub support.

[theel0ja]

It works!

[theel0ja]

Mixed content should be fixed.

[mourner]

@theel0ja great! It started working for me for https://leafletjs.com, but for some reason https://www.leafletjs.com times out. Is this an issue on the GitHub side or with our configuration?
Let's fix the mixed content thing — want to do a PR?

[theel0ja]

@mourner www.leafletjs.com is directed to a Namecheap IP address.

https://iplookup.theel0ja.info/?host=www.leafletjs.com

I'm going to do a PR for the mixed content things.

[mourner]

@JasonSanford does the above mean we should add some records on the DNS config side for www specifically?

[JasonSanford]

That sounds right. Let me look in the DNS config.

[JasonSanford]

The DNS settings had the www subdomain redirecting to http, not https. I've changed this and it should be propagating now.

[mourner]

@JasonSanford hmm, will a redirect work with https? It seems that it wouldn't. Could we just add records for www to point to GitHub IPs just like for the core domain?

[theel0ja]

https://github.com/Leaflet/Leaflet/pull/6150

[mourner]

Merged the mixed content fixes. https://www.leafletjs.com is still not working — let's wait for a fix to that, and then I'll be able to turn on "enforce https" in the settings.

[JasonSanford]

I mess around with DNS about once a year and always struggle. What I've got below is apparently not working. Anyone have ideas?

[JasonSanford]

Here's the rest of the records for reference.

[mourner]

@JasonSanford found this GitHub help page which suggests pointing CNAME to the GitHub domain, e.g. leaflet.github.io — not sure if it's applicable in our case but maybe worth a try.

[mourner]

We're now enforcing https, and also www.leafletjs.com redirects to https://leafletjs.com, which is good enough to close this issue. The only remaining thing is that https://www.leafletjs.com doesn't work, but let's leave it at that and maybe find a solution later.

[mourner]

Hmm suddenly https://www.leafletjs.com started to work — no idea what changed (maybe some cache updated) but great :) @JasonSanford no further action needed then.