Before running these instructions, set up SSL on your machine. See http://docs.moodle.org/27/en/Apache#SSL for instructions. If you are on Ubuntu, you can use the snakeoil cert instead of generating a cert http://charles.lescampeurs.org/2012/01/14/ubuntu-11-10-setting-up-apache2-and-ssl-with-self-signed-certificate Before upgrading Set the moodle wwwroot to have "http://" at the beginning Enable loginhttps Log out and make sure you can login (to test https) Upgrade moodle Ensure your moodle instance is now on https:// Make sure there is no longer an entry in the config table for loginhttps Verify that the forgotten password link, login and changing of passwords work Go to the create user page, click on the help icons next to some of the text boxes, verify the help box is displayed Go to the notifications page. (<your_moodle>/admin/index.php) Make sure you see "HTTPS for logins has now been deprecated. This instance is now forced to SSL. To remedy this warning change your wwwroot in config.php to https://" Manually go to login/index.php. Click cancel. Make sure you are redirected to the dashboard. Log out Make sure you are taken to the home page Log in again Go to Site administration ▶︎ Plugins ▶︎ Authentication ▶︎ Manage authentication Enable self registration Copy your keys from https://www.google.com/recaptcha/admin into the recaptcha fields at the bottom of that page Go to Site administration ▶︎ Plugins ▶︎ Authentication ▶︎ Email-based self-registration Enable recaptcha for self registration Log out Try to sign up Make sure the captcha is shown Log in as admin Go to dashboard Upload some files to my private files and in folders Use the tree / hierarchical view. Make sure you see the images successfully. Set the moodle wwwroot to have "https://" at the beginning Load any page in moodle Make sure there is no longer an entry in the config table for overridetossl Go to the login page Verify that the forgotten password link, login and changing of passwords work and use https Click on the help icons next to some of the text boxes, verify the help box is displayed Set your wwwroot back to http Verify that the site now uses http again with no warning about loginhttps Insert a new row in the table with name: loginhttps and value: true Go to the login page Verify that the forgotten password link, login and changing of passwords work and use http Fresh install Install moodle on a url with "http://" at the beginning (or use mdk or cli moodle, check that the wwwroot in config.php has 'http://' at the beginning) Verify that the forgotten password link, login and changing of passwords work Go to Site Administration>Security>HTTP Security Verify that the login https setting is not visible Enable Gravatar at Administration > Site administration > Users > Permissions > User policies Edit a user's profile Set the user's email to an address that you know has a gravatar (jlokely@gmail.com works) Verify that the user's picture is shown Open the image in a new tab, check that the url has "http://" at the beginning Log out Change the site's wwwroot in config.php to have "https://" at the beginning Use the forgotten password link, log in, change your password, verify that it is all https and works View the user's profile, verify that the gravatar picture is shown Open the image in a new tab, check that the url has "https://" at the beginning