All websites should be encrypted. Definitely don’t do anything secure over an unencrypted connection.
To support that the site has always had SSL setup. However I just discovered that the SSL certs the site uses by StartSSL have been revoked by all major browsers it appears!
A little digging for a new free SSL cert site came up with Let’s Encrypt. That in combo with Certbot is SUPER EASY to get certs and keep them up to date. All for free! I’ll probably even donate it’s so easy now!
The trick for certbot for me was to use the standalone check so I didn’t have to mess with the NGINX server’s folder security.
$ certbot certonly --standalone -d example.com -d www.example.com
Then you just point NGINX to the PEM files it creates and you’re set!
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
EASY PEASY! Now Chrome and Safari work again!
Then to renew all the certs at once you can run this
certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"