Implementing SSL (https)

Implementing SSL (https)

by Scott Chillemi -
Number of replies: 2

I'm considering implementing SSL for my Moodle site.  I found the checkbox under: Home/ ► Site administration / ► Security/ ► HTTP security which would turn on HTTPS for just the login page and then use HTTP everywhere else for better speed.

Is it possible to also turn on HTTPS for a single course, but allow the other courses to remain HTTP, which I understand is much faster?

My service provider will sell me a certificate, but doesn't know how to manage it within Moodle. 

I'm using Moodle 2.5.2, do I lose any other features when I go to HTTPS? 

 

Thanks,

 

Scott

Average of ratings: -
In reply to Scott Chillemi

Re: Implementing SSL (https)

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

With modern browsers it's no longer the case that https is much faster (or possibly any faster). If you want the whole site to be https it's mostly not a Moodle issue. Make your wwwroot in Moodle's config.php https and then add a rewrite rule to your web server to force all http to https

See http://wiki.apache.org/httpd/RewriteHTTPToHTTPS

Average of ratings: Useful (3)
In reply to Howard Miller

Re: Implementing SSL (https)

by Andrew Lyons -
Picture of Core developers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Testers

I agree with Howard. There is no good reason in this day and age to make your site partially SSL. I'd definitely recommend putting the entire site behind SSL.

The only thing you really should be aware of is that you will see warnings for any part of a page which attempts to load content from a non-http source (e.g. you have an image which is loaded from off-site from ). With things like the Media filters, Moodle does use the HTTPS equivalent where possible (e.g. http://youtube.com becomes https://youtube.com when embedding youtube videos), but not all sites offer HTTPS yet so this is not always possible.

Best wishes,

Andrew

Average of ratings: Useful (2)