Error on Step 4 (option 2) about gethttpsforfree

[pdreijnders]

The same procedure seem to work when used on gethttpsforfree.com

[diafygi]

Howdy, a few questions:

• Did you run the command above the options and copy in the results?
• If you refresh the page and try the entire process again, do you still get the error?

Are you still getting the error? If so, when you get the error, can you please open your debugger console and run the following commands?

console.log(JSON.stringify(ACCOUNT_PUBKEY));
console.log(JSON.stringify(CSR));
console.log(JSON.stringify(DOMAINS));

[diafygi]

@pdreijnders since it's been over a week, I'm going to assume that you resolved your issue. Please ask to reopen if not.

[madbence]

I've had the same issue, ACCOUNT_PUBKEY had no thumbprint, right now I'm investigating...

[madbence]

Ok, it seems that window.crypto.subtle.digest is only available on secure origins on chrome, as the thrown error suggests (DOMException: Only secure origins are allowed (see: https://goo.gl/Y0ZkNV).), but the error is ignored, so it results in an empty thumbprint.

A simple workaround is to access the page through https (gh-pages are accessible through https), or use an other browser (eg. firefox seems to allow window.crypto functions on http sites).

[diafygi]

@madbence Interesting, I'm unable to reproduce this (works for me on both file://.... and http://localhost:8000/...). As stated in the link in the error the following are whitelisted as secure origins.

(https, *, *)
(wss, *, *)
(*, localhost, *)
(*, *.localhost, *)
(*, 127/8, *)
(*, ::1/128, *)
(file, *, —)
(chrome-extension, *, —)

Can you please create another bug and give more details about your setup? Thanks!

[madbence]

@diafygi try to access the site through http: http://diafygi.github.io/gethttpsforfree/ (fails on chrome 47.0.2526.80)

[diafygi]

Ah, ok, please try https://diafygi.github.io/gethttpsforfree/

Nothing I can do about github not automatically redirecting to the https version. I'd highly suggest the HTTPS Everywhere plugin from the EFF.

[madbence]

fyi you can detect the used protocol: window.location.protocol, but yeah it makes sense to use the site through https 😸.