What are NationBuilder's SSL offerings for websites? I've observed that secure pages are becoming a standard across the web. Some browsers like Google Chrome will even throw up an error when trying to access non-SSL pages. I would like to know what NationBuilder can do to allay my concerns.
Update 03/05/2018
All NationBuilder sites that have their domains configured correctly, and no insecure content, have been upgraded to SSL! You will have received an email confirming your update.
If your site has insecure content you will need to go to your website > settings > insecure content and remove any insecure images or files. Once that is complete you will see a button to upgrade to SSL.
Ongoing all NationBuilder sites with their domain hosted by NationBuilder will have SSL!
If you have any questions please contact our support team at [email protected].
Update 02/01/2018
We are currently adding all correctly configured custom domains to SSL certificates, We’ll update here when that work is complete!
You may have some insecure content on your site (most sites don't) but you can double check and learn more about any changes you need to make - "How to check your site for insecure content."
Update 11/21/17
Today, we started the process of upgrading all existing websites with custom domains to full site SSL so that every page on your site is encrypted. This process should be complete by the end of January and - beginning February 1st, 2018 - all new custom domains will automatically have SSL enabled.
As long as your custom domain is properly configured, you don’t need to do anything! This upgrade will be seamless, free, and any links on the internet to the non-SSL pages will automatically redirect.
Update 8/18/17
NationBuilder is aware of the updates from Google Chrome and recognizes the need for custom domain SSL.
The team continues work to make SSL less cost-prohibitive.
As you have observed, it is becoming a standard across the web for all pages to be SSL secured. It sounds like Google is moving in that direction. NationBuilder is too. At the moment, NationBuilder can offer SSL on all websites as long as they are not using a custom domain. Therefore, if you used https://[slug].nationbuilder.com/* without the custom domain, you could enjoy SSL on all of your pages on the website. If you choose to use a custom domain, you can still enjoy SSL encryption, but just on the donation, login and control panel pages which use SSL on the https://[slug].nationbuilder.com format. These pages are secured so that sensitive information on this site (for example, passwords or credit cards), are not stolen by attackers.
Now that said, NationBuilder is working on a way to offer SSL on all websites, including those that use a custom domain. However, at the moment, the process to accomplish this is cost-prohibitive. Therefore, we can only offer custom domain SSL as an add-on if you're using one of NationBuilder's Organization or Network plans.
In the future, it is a priority of our Product team to find a way to make SSL available and affordable for all NationBuilder websites with custom domains. If you are interested in following this process, please follow the public issue on custom domain SSL.
Relevant:
Showing 40 reactions
Sign in with
(Response is not acceptable and gives zero indication NationBuilder, who has been aware this is a problem for more than 8 months, is doing anything about it.)
“We’re aware of the Google Chrome advisements and as you know, the option for SSL is available for the Enterprise and Network plans as add-ons. If you’re interested in any of those plans I’m happy to connect you with the appropriate teams here at NationBuilder. However, up to this point, we’re still developing a way to offer SSL affordably.
“The current holdup is not necessarily the cost to purchase a certificate, but the process in which to install the certificate while also maintaining the services that provide NationBuilder DDOS security. This process is cost-prohibitive at the moment. Because of this, I encourage you to continue reviewing the public resources for more updates.”
Message type: [WNC-10038795]
Search Console
Chrome will show security warnings on _____
To owner of ______,
Starting October 2017, Chrome (version 62) will show a “NOT SECURE” warning when users enter text in a form on an HTTP page, and for all HTTP pages in Incognito mode.
_____
The new warning is part of a long term plan to mark all pages served over HTTP as “not secure”.
Here’s how to fix this problem:
- Migrate to HTTPS
- To prevent the “Not Secure” notification from appearing when Chrome users visit your site, only collect user input data on pages served using HTTPS.
The cost comes not from acquiring certificates, as you point out, but from hosting those many certificates in a way that also protects customers from DDOS attacks, and makes their websites’ content fast to access across the globe. We’re actively negotiating with our providers, and we hope to have some updates on this front soon.
I believe we are one of the larger NationBuilder sites, and yes, we’ve received a notice from Google about SSL encryption. We use our own domain name on NationBuilder, so we’re excluded currently from having all our pages secured.
Given that we are political news and opinion website, and receive our share of partisan criticism, we would very much like to have some additional protections. We’d also be very happy to help in the testing phase, if that would move things forward.
Truly hope this is something NationBuilder can achieve this year, and happy to help in any way we can!