HTTPS has been one of those things on just about everyone's wishlist for a long time. We've all got different priorities for this, but I'd say it should now be fairly high - particularly when we're talking about logging in and private wikis.
We missed the big craze over state-sanctioned surveillance, however, we should still be working pretty actively to sort this.
In the past, our main blocker has been that our URL scheme has made it difficult to cover the entire farm in our certificate. Our wildcard is *.shoutwiki.com which covers a large number of our wikis, but not those that use a language prefix in their URL (such as de.foobar.shoutwiki.com) We can't get a double wildcard (*.*.shoutwiki.com)
We need to have a discussion about how we're going to finally solve this problem.
Previous solutions suggested are:
- Remove all sub-subdomains and keep the current wildcard.
- Change the pattern to wiki.language.shoutwiki.com and use SAN or additional certificates (now a lot easier thanks to Let's Encrypt) to cover this pattern.
- Don't implement HTTPS.