<story><title>HTTPS on Stack Overflow: The End of a Long Road</title><url>https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/</url></story><parent_chain><item><author>mrunkel</author><text>At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our &amp;quot;website was down.&amp;quot;&lt;p&gt;After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren&amp;#x27;t available to them.&lt;p&gt;We didn&amp;#x27;t think this would be a problem because the current version of the software wasn&amp;#x27;t compatible with WinXP any longer.&lt;p&gt;There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.&lt;p&gt;In the end we had to include the legacy protocols so those customers could use our online store.</text></item></parent_chain><comment><author>madmax108</author><text>At $current_job we&amp;#x27;re currently in the middle of the same thing, but took the precaution of checking logs to see which customers use older encryption protocols (we&amp;#x27;re B2B), and have given them X months to upgrade their systems before we make the switch on our side.&lt;p&gt;The logic that was communicated to them was that as a service provider, security a prime concern for us (as it should be for them as well), so we can&amp;#x27;t keep lagging on this forever. Currently, we have $single_digit merchants we&amp;#x27;re still waiting to make the switch.&lt;p&gt;It&amp;#x27;s made the whole switch process much easier and made customers actually appreciate our pro-activeness in this! :)</text></comment>
<story><title>HTTPS on Stack Overflow: The End of a Long Road</title><url>https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/</url></story><parent_chain><item><author>mrunkel</author><text>At $previous_job we once turned on HTTPS for our entire customer website and online store, only to have our customer support team be bombarded by phone calls claiming that our &amp;quot;website was down.&amp;quot;&lt;p&gt;After much teeth gnashing and research, we determined that a large segment of our user base was still using WinXP and the encryption protocols we offered weren&amp;#x27;t available to them.&lt;p&gt;We didn&amp;#x27;t think this would be a problem because the current version of the software wasn&amp;#x27;t compatible with WinXP any longer.&lt;p&gt;There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.&lt;p&gt;In the end we had to include the legacy protocols so those customers could use our online store.</text></item></parent_chain><comment><author>gatlinnewhouse</author><text>&amp;gt; We didn&amp;#x27;t think this would be a problem because the current version of the software wasn&amp;#x27;t compatible with WinXP any longer.&lt;p&gt;&amp;gt; There was some debate internally whether the better fix was to including the legacy encryption protocols or just leave the HTTP version of the site running and use Strict-Transport-Security to move capable browsers to HTTPS.&lt;p&gt;Where can I read about this? Is there any way to display a special &amp;quot;Your browser is outdated&amp;quot; page for the users on WinXP?&lt;p&gt;Sorry if these seem like basic questions. I am just curious and would like to hear some expert advice.</text></comment>