[[TranslatedPages]]
[[PageOutline]]

= Configure your web site to use https =

By default, your web site does not communicate with the world using an encrypted connection. When you connect, it uses the "http" protocol instead of the "https" protocol.

We strongly encourage all members to change this setting so all communications is encrypted. Even if you don't think it is necessary, consider that all information you send to the site, which may include usernames and passwords, are sent in the clear unless you are using https.

Fortunately, the process of choosing to run an https enabled web site is fully handled in the members control panel:

 * Log in via https://members.mayfirst.org/cp.
 * Choose the "Web Configuration" section.
 * Remove any domains from ServerAlias or ServerName that are a sub-domain of mayfirst.org (e.g. yourorg.mayfirst.org). You should only have your own personal domains listed (this is temporary until #12045 is resolved).
 * Edit your web configuration and change the "Port" field to "auto".
 * Click "Submit".

== How does it work? ==

You have several options when choosing to configure your web sites. Each site will have and does need at least one web configuration item.

=== auto ===

The best option is to use "auto." When your web site is configured to use auto, then:

 * A [https://letsencrypt.org/ letsencrypt] certificate will be automatically generated at no cost for all the domains in your web configuration (both Server Name and Server Alias).
 * This certificate will be automatically updated every three months
 * All requests sent via http will be automatically redirected to https

=== http ===

If you prefer,  you can opt instead to have an http-only site by choosing http.

=== https ===

You may also wish to use your own certificates, in which case select "https" and specify the `SSLEngine On`, `SSLCertificateKeyFile`, and `SSLCertificateFile` parameters in your configuration that point to the appropriate files. If your web configuration has only an https item, you won't have an http site at all. Note that this means anyone trying to reach your site with http:// will get an "Error 404 Server not found" message.

=== Both http and https ===

You can also choose to have a different web configuration for http and https or control the redirecting in a more fine-tuned way. For sites that have https enabled with a certificate that they purchased or obtained themselves, their web configuration will have two items: one for each http and https.

== What if I already have an https web site? ==

You can easily convert your site from an https web site to an auto web site.

If you have both an http and an https web configuration, you must first delete the http one.

Then, edit the https site, remove the SSL lines, and change it to auto.