| Subject: | No/broken HTTPS support for strawberryperl.com |
| Date: | Mon, 15 Jan 2018 14:10:57 +0100 |
| To: | bug-Perl-Dist-Strawberry [...] rt.cpan.org |
| From: | Michele Cicciotti <michele.cicciotti [...] pynlab.com> |
strawberryperl.com, including (especially) the downloads, is only
available over plaintext HTTP. Considering that the downloads have
neither internal (Authenticode) nor external (GPG) signatures, at least
the download channel should be protected against tampering. Right now,
strawberryperl.com does respond to HTTPS, but it's clearly not
configured, as it uses what appears to be the hosting provider's default
certificate
Should you add HTTPS support (which is free and easy to set up, thanks
to services like Let's Encrypt <https://letsencrypt.org>), make sure to
test your configuration using Qualys's SSL Server Test
<https://www.ssllabs.com/ssltest/>, because it's tricky to get right