# How to secure my Discourse page with https and update my TLS to 2.0 **URL:** \ **Category:** Help\ **Created:** [October 30, 2020, 7:46am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178 "2020-10-30T07:46:35Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Desray](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Desray](https://community.letsencrypt.org/u/Desray)\ **Post date:** [October 30, 2020, 7:46am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/1 "2020-10-30T07:46:35Z")
I'm running a discourse forum here at [https://www.avdisco.com](https://www.avdisco.com). I was told by a helpful member here that my forum is at risk without proper https...I thought I already have. But I guess I'm not? As I'm more of a user and content creator rather than web security expert here. Need advice on how to secure my forum. Anyone can reach me how with a simple step by step guide. BTW my Discourse forum is hosted on Digital Ocean. Thanks in advance. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 30, 2020, 7:52am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/2 "2020-10-30T07:52:41Z")
Hi and welcome to the LE community forum! I got a heads up that you were coming from @JimPas 🙂 Looking into this now: [https://www.ssllabs.com/ssltest/analyze.html?d=www.avdisco.com](https://www.ssllabs.com/ssltest/analyze.html?d=www.avdisco.com) Looks like the cert doesn't have the "www" in it ☹ ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 30, 2020, 7:55am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/3 "2020-10-30T07:55:59Z")
As for the shorter name, that one looks A+ > **[SSL Server Test: avdisco.com (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=avdisco.com)** So, let's see how we can get the right names on the cert... How did you get the cert you have now? What was the exact command you ran, if any? READERS: Get involved and participate: If you read something you like, then click to like it ❤ ---
**Author:** ![Desray](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Desray](https://community.letsencrypt.org/u/Desray)\ **Post date:** [October 30, 2020, 8:16am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/4 "2020-10-30T08:16:35Z")
I'm not sure as well. I used ocean digital droplet to create the Discourse forum. I point the DO droplet that host my Discourse to Cloudflare DNS to manage it. And that's about all. I didnt set up SSL. Is this anything serious. This is just a hobbyist forum. Shouldn't all this behind the scene web security be taken care of by Digital Ocean? That's what I led to believe. ---
**Author:** ![Desray](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Desray](https://community.letsencrypt.org/u/Desray)\ **Post date:** [October 30, 2020, 8:18am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/5 "2020-10-30T08:18:03Z")
Looks like I just need to point to [https://avdisco.com](https://avdisco.com) instead of adding the "www" to overcome this problem? Am I right? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 30, 2020, 8:18am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/6 "2020-10-30T08:18:27Z")
> [@Desray](#): > > Is this anything serious It looks bad if someone types your site with the www, they will get a security warning. Some browsers may not even let them continue in to it. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 30, 2020, 8:20am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/7 "2020-10-30T08:20:27Z")
> [@Desray](#): > > Looks like I just need to point to [https://avdisco.com](https://avdisco.com) instead of adding the "www" to overcome this problem? Am I right? Easier said than done. You can't change every thing ever written about your site on the Internet. You can't stop someone from typing www. first out of habit. You can: Ask DO how that cert was installed and how can you get the www in on the next renewal. ---
**Author:** ![Desray](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Desray](https://community.letsencrypt.org/u/Desray)\ **Post date:** [October 30, 2020, 8:25am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/8 "2020-10-30T08:25:02Z")
I see. Thanks for the great tip. I'll drop a support ticket to DO to seek clarification on the https issue with the "www" and see if anything can be done to secure my site. ---
**Author:** ![Desray](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Desray](https://community.letsencrypt.org/u/Desray)\ **Post date:** [October 30, 2020, 8:26am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/9 "2020-10-30T08:26:46Z")
Alternatively, can I do a DNS forwarding to [https://avdisco.com](https://avdisco.com) whenever user typed [www.avdisco.com](http://www.avdisco.com)? Does that help? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 30, 2020, 8:28am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/10 "2020-10-30T08:28:05Z")
Only for [http://www](http://www) If they type, or hit a link that has, [https://www](https://www) it's too late - they will get the security warning message. Actually, it is not DNS forwarding - can't be fixed in DNS (that only changes names to numbers). It is redirection in HTML / web service. ---
**Author:** ![Desray](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Desray](https://community.letsencrypt.org/u/Desray)\ **Post date:** [October 30, 2020, 9:44am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/11 "2020-10-30T09:44:27Z")
Ok thanks. I looking to OD for answer. Clearly they asking me to do a certbot cmd. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 30, 2020, 9:45am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/12 "2020-10-30T09:45:48Z")
OK we can do that 🙂 Please show the output of: `certbot --version` `certbot certificates` ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 29, 2020, 9:46am UTC](https://community.letsencrypt.org/t/how-to-secure-my-discourse-page-with-https-and-update-my-tls-to-2-0/137178/13 "2020-11-29T09:46:00Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.