# Allow both http and https images over Tor?

**URL:** <https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693>\
**Category:** Support\
**Created:** [September 16, 2019, 2:34pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693 "2019-09-16T14:34:02Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![hellekin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hellekin/32/51636_2.png) [@hellekin](https://meta.discourse.org/u/hellekin)\
**Post date:** [September 16, 2019, 3:23pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/4 "2019-09-16T15:23:02Z")

</div>

Using TLS over Tor is indeed overkill (since Tor Hidden Services are already encrypted) but if your site has a DNS-visible domain, you should be able to add a Subject Alternate Name that matches `.onion` in your SSL certificate – except that [LetsEncrypt does not support it yet](https://community.letsencrypt.org/search?q=onion).

If indeed you have both `HTTPS` and `HTTP+Tor`, it’s a bit of a problem. Maybe instead of `force_https`, Discourse could use the shortcut `//` like for assets, or use `path_only` so that the full URL is determined by the host, and thus always match the calling scheme.

---

_[View the full topic](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693)._