Chrome 56 (Jan 2017) will mark sites not using SSL as "Not Secure"

[glennrocksvb]

Be prepared. Soon you will see a "Not secure" red warning in the Chrome address bar if the site is not using HTTPS. See more info from the link to the Google blog below.
There's a way to get a free SSL Certificate and I'm planning to get it. I actually did but never had a chance to install it on my server. I think it already expired so I had to get a new one again.

https://www.sslforfree.com/

https://letsencrypt.org/

[Felix2]

Chrome must be the only modern browser to not indicate an insecure connection ;P
I have my own SSL generator, works great, but many browsers whine that it is self signed.
I sometimes use Comodo's FREE SSL, but it is only good for 3 months before you need to purchase it.

I tried out https://www.sslforfree.com/
Disappointing. Tried manual and FTP methods. Files transfer and authenticate, but no certificate is ever generated.
Instead, get an error message.

Server error 302. Make sure directory is publicly accessible through port 80. Turn off password protection temporarily if on. Ask your host if unsure about the directory or try using an FTP client or >web FTP if you do not have an FTP client to try finding it out.

https://letsencrypt.org/, which is just a front to https://certbot.eff.org/, is only good for UNIX flavors.

Certbot is currently only available for UNIX-like operating systems. Although EFF's Certbot might not work for your use case, there are many other clients written by other organizations and developers that you may be able to use to obtain a certificate from Let's Encrypt.

As an estimated 70% of the worlds servers (DEATH to IIS!) are now Apache, and half of those are on XP systems, this is a poor choice.
Fortunately, a number of alternatives are offered at https://community.letsencrypt.org/t/...entations/2103
None of them provide for security encryption over 2048bits, but they work well for most browsers.
Also, most of them are pay services. Like I am going to pay someone to tell me my site is encrypted.

https://gethttpsforfree.com/ works, sometimes, and is the one I recommend to those without knowledge of HTTPS process setup.
Other things people need to keep in mind is updating .htaccess to redirect all http to https; changing vB's settings; slower page loads on large sites.
You also have to make a number of Apache configuration changes, which none of these sites cover.
So it isn't as simple as enter info, get file, store it and you are done.

https://zerossl.com/free-ssl/ is good for almost anyone too as a no brainer and uses a browser setup. Again, this is only to create the SSL cert, not install it or reconfigure an HTTP to HTTPS server.
Pro, you don't have to know hardly a thing about setting up certificates.
Con, it is all automated and you have no control over configuring your certificates.
Also,

Please note that certificates are valid for 90 days, but they are free to renew.

Pro, it is free.
Con, PitA to have to do this every 3 months when standard is 1-10 years.

[glennrocksvb]

I was able to generate the SSL certificate through sslforfree.com after following their instructions for manual verification. Below is my SSL cert.

It expires after 90 days. But they said you could set up a crontab on your server to auto-renew after 90 days. So essentially you wouldn't have to worry about it as long as the crontab works.

[glennrocksvb]

Chrome must be the only modern browser to not indicate an insecure connection ;P

Chrome does right now. You just have to click the (i) icon to see "Your connection to this site is not private" in black font. Firefox does the same thing, you also have to click the (i) icon to see "Connection is Not Secure" in red font. It is Microsoft Edge and IE which don't have any indicator when a site is not using SSL (it does display lock icon when using SSL but nothing when not SSL). I couldn't even find anything that says "not secure" even when clicking around the address bar or settings.

The future change in Chrome is it will display "Not Secure" in red font with warning icon and you will see it right away in the address bar without clicking anything. So it's basically "scaring" users to "force" site owners to use SSL. This is for the benefit of site owners. I'm all for it.

[NumNum]

I think its a good idea, kudos to google.

The unfortunate thing for me is, my host would charge me $99.00 a year for ssl. Not that I need it on my personal site as its basically just a blog.

[glennrocksvb]

I know. That's why I'm going to use a free SSL certificate.

Anyway, Google has been using HTTPS as a ranking signal since 2 years ago. This means that secure sites rank higher in Google.

[William]

I took advantage of a free life time promotional offer by Siteground Hosting. The certificate auto renews once every year.

Enjoy,
William