Simple: Don't. Developing a secure authentication service is actually more difficult than it would seem on the surface. I've come to rely on an external authentication service (or, if necessary, a reputable library/framework specifically designed for it). These days my go-to is Keycloak (https://keycloak.org). It supports pretty much everything: standard username/password, MFA, SAML, OIDC, etc. Plus, it's easily deployable within a Docker container so standing it up is a breeze.
I haven't heard of keycloak before, but I'm not sure what to make of their SSL cert not being valid for the non-www version of their domain (i.e. your link). Such a oversight doesn't exactly inspire confidence in a security related product.
Well, the URL is missing www so you see the bad certificate error; Although, I agree that they should have handled automatic redirection from non-www to www.
Comments
Simple: Don't. Developing a secure authentication service is actually more difficult than it would seem on the surface. I've come to rely on an external authentication service (or, if necessary, a reputable library/framework specifically designed for it). These days my go-to is Keycloak (https://keycloak.org). It supports pretty much everything: standard username/password, MFA, SAML, OIDC, etc. Plus, it's easily deployable within a Docker container so standing it up is a breeze.
I haven't heard of keycloak before, but I'm not sure what to make of their SSL cert not being valid for the non-www version of their domain (i.e. your link). Such a oversight doesn't exactly inspire confidence in a security related product.
I'm certainly going to trust an authentication service with a bad certificate.
Well, the URL is missing www so you see the bad certificate error; Although, I agree that they should have handled automatic redirection from non-www to www.