Making CMS more secure by moving sites to HTTPS everywhere

Security and accessibility are our two key priorities for sites on UBC CMS. We continue to make improvements on both fronts, and we’ll have more to discuss in the coming months about accessibility specifically.

For the past 18 months we have slowly been migrating individual sites on CMS from HTTP to HTTPS. This means that when users visit your site, depending on the browser they are using, they will see a padlock next to the URL as it will use the HTTPS protocol. (the ‘s’ being ‘secure’)

For sites that have been transitioned, HTTPS is forced. For example, if your URL is something.ubc.ca and someone tries to visit http://something.ubc.ca/ then they will be force redirected to https://something.ubc.ca/

With our colleagues at UBC IT Cybersecurity we have installed SSL certificates for all sites on CMS. This means that, if your site hasn’t yet been transitioned to HTTPS by default, then users will be able to access your site on HTTP and HTTPS. With your help, we have transitioned several hundred – approximately 70% of – sites at this point.

We are now planning on migrating the remaining sites.

Under the hood, CMS has 2 IP addresses that directs domains to our servers. 206.87.224.37 allows both HTTP and HTTPS traffic whereas 206.87.224.50 force redirects HTTP to HTTPS before the connection ever reaches the servers that run CMS. Currently the way sites are migrated is for you, your IT team, or UBC IT to switch the IP address for the domain used for your site from 206.87.224.37 to 206.87.224.50 and then for us to run a migration tool on your site.

On Saturday October 30th we will change the 206.87.224.37 IP address to mimic what the 206.87.224.50 address does i.e. 206.87.224.37 will force redirect HTTP traffic to HTTPS. Additionally, we will run our migration tool on all sites that haven’t yet been migrated.

What does this mean for you?

If you administer a site that isn’t currently running on HTTPS, you can do one of two things. 1) At your convenience, before October 30th, send us an email to lt.hub@ubc.ca and we will help you migrate before October 30th or 2) Wait until October 30th and this will be done automatically. The automatic migration will require you to manually verify your site is working as expected. It’s possible you will need to re-save any custom CSS you have, or possibly re-save your theme options. If, after October 30th, you see any visual anomalies that aren’t resolved by saving your CSS and theme options, please email lt.hub@ubc.ca and we will investigate for you.