make the website operate fine with https

[roblanf]

Referencing this:

#363 (reply in thread)

The issue is that if you navigate to:

https://iqtree.org

you can't view the website, with an error something like:

This site can’t provide a secure connection
iqtree.org uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite.

the website works fine if you use http, e.g.

http://iqtree.org

Why this is a problem

On the one hand, it's easy to direct people to use http. But, for a lot of browsers (including oftentimes when this happens to me) the default goes to https, meaning that a lot of time the website just appears not to work. So while it's easy for us to say to users who ask why the website's not working, the fact remains that many users will often just assume that the website is down and not even ask.

[roblanf]

I know nothing about http and https, but for what it's worth, chatGPT seems to know enough to get us started here. Full conversation:

https://chatgpt.com/share/67523bcd-bdfc-800b-bdae-98bdd9bc05db

Response for easy reference:

Issue Explanation

The error ERR_SSL_VERSION_OR_CIPHER_MISMATCH occurs because the website’s HTTPS configuration is not properly set up. Although the site is accessible via http://iqtree.org, attempts to use https://iqtree.org fail, indicating that the server and the client cannot agree on a secure encryption protocol and cipher suite.

Why This Matters

• Modern browsers and search engines heavily encourage (and sometimes enforce) HTTPS.
• Users often type just the domain name and rely on their browser to default to https://.
• Without proper HTTPS, many visitors will see a broken site and may assume it’s down or unsafe.

How to Fix It

1. Obtain a Valid SSL/TLS Certificate
   You’ll need a trusted certificate from a Certificate Authority (CA).

   • Free option: Let’s Encrypt
   • Paid options: DigiCert, GlobalSign, etc.

   After obtaining a certificate, you’ll have:

   • A fullchain.pem (or similar) file with the server’s certificate and intermediate CA certificates.
   • A privkey.pem (your private key).

2. Server Configuration

   Depending on your web server, configure it to serve HTTPS using the certificate files.

   Nginx Example:

   server {
       listen 443 ssl http2;
       server_name iqtree.org;
   
       ssl_certificate /path/to/fullchain.pem;
       ssl_certificate_key /path/to/privkey.pem;
       ssl_protocols TLSv1.2 TLSv1.3;
       ssl_ciphers HIGH:!aNULL:!MD5;
   
       # Your existing server configuration here
   }
   
   # Optional HTTP to HTTPS redirect
   server {
       listen 80;
       server_name iqtree.org;
       return 301 https://$host$request_uri
   }

   Apache example

   <VirtualHost *:443>
    ServerName iqtree.org
    SSLEngine on
    SSLCertificateFile /path/to/fullchain.pem
    SSLCertificateKeyFile /path/to/privkey.pem
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5
   
    # Your existing configuration (DocumentRoot, etc.)
    </VirtualHost>
   
    # Optional redirect in the VirtualHost on port 80
    <VirtualHost *:80>
        ServerName iqtree.org
        Redirect permanent / https://iqtree.org/
    </VirtualHost>

3. Test the Configuration

Use tools like SSL Labs’ SSL Test to verify that:

• Your certificate is valid and trusted.
• You’re using secure, modern TLS protocols (at least TLS 1.2).
• No weak ciphers or deprecated protocols are enabled.

Conclusion

By properly configuring HTTPS—acquiring a valid SSL/TLS certificate and ensuring your server uses modern, secure protocols—you can eliminate the ERR_SSL_VERSION_OR_CIPHER_MISMATCH error. This ensures a secure, functional, and trustworthy experience for your users accessing https://iqtree.org.

[artur-sannikov]

@roblanf, depending on how your website is setup, it might be trivial to use a reverse proxy like Caddy. This might be as easy as having Caddy installed on your server and have /etc/caddy/Caddyfile with

iqtree.org:80 {
	reverse_proxy localhost:<port_number_of_website>
}

Then just point your DNS records to the IP address of the server.

Caddy will automatically retrieve a Let's Encrypt certificate and will renew it every 60/90 days.

If the website is set up by your University, then they should already have everything set up.

P.S. I can see that your website https://www.robertlanfear.com uses a Let's Encrypt certificate.

[bqminh]

I requested the system admin to support https a long time ago, but they said that the server is going to be replaced. I don't know when that will happen, but nothing we can do from our side, unless we transfer the domain to ANU.