Subject: [TOOLS-DEVELOPMENT] http no longer working on ietf.org

From: Lou Berger <[email-masked]>
Date: Sun, 13 Nov 2016 22:35:15 +0900

Is there a reason that http requests are being redirected to https?
(e.g., http://www.ietf.org/audio) There are certainly valid use cases
for unencrypted traffic - why are we breaking these?

Thanks,

Lou

---

From: Glen <[email-masked]>
Date: Sun, 13 Nov 2016 07:53:25 -0800

> for unencrypted traffic - why are we breaking these?

Lou -

The IETF servers are not doing this, so it appears to be a CloudFlare
thing.  I've asked our system administrator, Matt Larson, to look into
this and find out why this is happening,  We'll get back with a report
and options as soon as he figures this out.

Glen

---

From: Lou Berger <[email-masked]>
Date: Mon, 14 Nov 2016 06:12:25 +0900

Thanks Glenn!

Lou

On November 14, 2016 12:54:23 AM Glen <[email-masked]> wrote:

> _______________________________________________
> TOOLS-DEVELOPMENT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-development
>

---

From: Glen <[email-masked]>
Date: Sun, 13 Nov 2016 13:13:51 -0800

> for unencrypted traffic - why are we breaking these?

Hi Lou, everyone -

Sorry for the delay in responding.

So, I couldn't find an explicit redirect in either our server or
Cloudflare...  and neither could Matt.

But in looking at the config, I am reminded that we have implemented
HSTS back last year, at the direction of the IETF.  That is the IETF
standard referenced in RFC 6797 (
https://www.rfc-editor.org/rfc/rfc6797.txt ) and implemented on all of
our servers at ths time.

That is why all connections are being redirected.  Actually we found
some browsers that are less-than-compliant, alas, but the point
remains that we are now running HSTS, and that is why HTTP requests
are being redirected to HTTPS.

I hope this information is helpful!

Glen

---

From: Lou Berger <[email-masked]>
Date: Mon, 14 Nov 2016 06:38:35 +0900

Thanks Glenn.  I bet I heard about this in the IAOC and forgot  - Do you
know who made the request?

Lou

---

From: Glen <[email-masked]>
Date: Sun, 13 Nov 2016 13:41:27 -0800

Hi Lou -

I do not recall who started the original discussion - but the original
discussion itself was about the fact that the IETF's website was
getting a very low score on various SSL test sites such as SSL Labs.
Enabling HSTS was something required to increase the score, and the
Tools Team made the determination to proceed.  How that went through
the various I*** chains is beyond my vision.  Perhaps Russ or Robert
could shed light on that for you; alas, I cannot.

Hope this helps!
Glen