# Consensus on SSL - what's everyone using?

**URL:** <https://www.ruby-forum.com/t/consensus-on-ssl-whats-everyone-using/172688>\
**Category:** Rails\
**Created:** [July 25, 2009, 5:46pm UTC](https://www.ruby-forum.com/t/consensus-on-ssl-whats-everyone-using/172688 "2009-07-25T17:46:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![northband](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ecae2f/32.png) [@northband](https://www.ruby-forum.com/u/northband)\
**Post date:** [July 25, 2009, 5:46pm UTC](https://www.ruby-forum.com/t/consensus-on-ssl-whats-everyone-using/172688/1 "2009-07-25T17:46:38Z")

</div>

Hi -

I need to use SSL in certain areas of my app. I have read about  
ssl\_required via the ‘book’ and online:

> **[GitHub - rails/ssl\_requirement: NOTICE: official repository moved to...](https://github.com/rails/ssl_requirement/tree/master)**
>
> master

It looks like what I need and want. However, I read that it may have  
issues with Nginx and that it may have loopholes in regards to  
securing requests from client to server.

[http://blog.aisleten.com/2008/06/02/beware-of-ssl\_requirement/](http://blog.aisleten.com/2008/06/02/beware-of-ssl_requirement/)  
I’m not certain of the validity of this or whether its been addressed.

So I’m curious - what’s everyone using for SSL?

Any help/tips greatly appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![northband](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ecae2f/32.png) [@northband](https://www.ruby-forum.com/u/northband)\
**Post date:** [July 26, 2009, 12:11am UTC](https://www.ruby-forum.com/t/consensus-on-ssl-whats-everyone-using/172688/2 "2009-07-26T00:11:05Z")

</div>

Hi,

I use ssl\_requirement. I read the blog post about the holes, and really  
there is absolutely nothing to worry about, simply make sure the page  
where the form is displayed has https in the URL and you’re 100% safe.

Anyway IE would issue a warning if the form that is about to submit data  
is not on a totally secured page (images, etc.). And now on Firefox 3.5  
an https url also has a blue bar (or green bar for Extended Validation)  
so the user has a better visual information that the page he is on is  
secured.

There are no security problems at all with ssl\_requirement.

---

<div class="post-metadata">

**Author:** ![northband](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ecae2f/32.png) [@northband](https://www.ruby-forum.com/u/northband)\
**Post date:** [July 26, 2009, 1:33am UTC](https://www.ruby-forum.com/t/consensus-on-ssl-whats-everyone-using/172688/3 "2009-07-26T01:33:42Z")

</div>

On my production server I proxy ssl through apache. On Bluehost I  
believe I will be doing the same thing.

On Jul 25, 3:11 pm, Fernando P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)