I'm a programmer, not a system admin. I have a DreamHost VPS that I screw around with for my personal Website and a number of side projects that are typically just experiments in multimedia through HTML5. Nothing particularly serious, and they all run client-side.
I've started to include signed certificates on my sites as A) it's just good for users, B) I might consider setting up user accounts for some multiplayer features in the nebulous future, and C) it also allows me to request access to certain HTML5 APIs once and only once. For example: speech recognition needs to be reconfirmed every time it is started on HTTP, and it automatically stops listening after a minute. But by using HTTPS, I can make it restart listening without the user needing to reconfirm it; the first confirmation was enough.
I have two separate servers running:
- Apache on port 80: https://seanmcbeth.com
- a Node.js-based, custom Web server on port 8080: https://seanmcbeth.com:8080.
I keep it this way because the Apache server was already running, it works well, and I'm still very new to Node. I keep Apache running to serve the static pages on my site that serve as a portfolio for my work and just trust that DreamHost has it configured far better than I'd be able to do on my own. The Node server falls over on occasion, and sometimes I don't notice, purely my fault with programming. Keeping the two separate seems like a good idea for now.
For Apache, DreamHost configured the certificates themselves, and I have the htaccess rules setup to redirect HTTP traffic to HTTPS. That works fine.
For the Node server, I copied the certificate and private key out of the DreamHost CPanel, because I couldn't figure out where they were located to use the same copies that Apache uses. I did not copy the intermediate certificate, as I couldn't figure out what to do with it. The Node server also does not automatically redirect HTTP traffic, but that's probably just me not yet having even researched the problem.
The primary issue I'm writing about today is that sometimes, when I type in the address directly for the the Node server on my smartphone (Android 4.4.2: Chrome 37), it tells me the site is "not secure". I then have to jump through hoops to get around it and go on anyway. This never happens on my PC (Windows 7: Chrome 37, Firefox 31, or IE 11) and it never happens on the smartphone if I use a link on a page served by the Apache server to go to the Node server. I'm posting here because I think this is more of a configuration issue than a programming issue.
I'd be more specific on the "not secure" part, but I can't seem to replicate the problem now. I'm concerned that I might have flagged the site as an exception and it now just blanket confirms it, but any new users are going to see the warning.
