As of September 2017 the MPU's affected web servers are in three categories:
ordershost
This will be going away with the old inventory system. The Tartarus equivalent is https only.
The LCFG slaves
There are currently 8 of these. Stephen has been looking at making LCFG work over https:
In normal use, switching the client to https just works.
Installs don't work, because they use LCFG servers called lcfg and lcfghost, which aren't in the server's certificate. To fix this we need subject alternate name support in lcfg-x509 - see Bug:1010.
During the install process some scripts call rdxprof, but rdxprof doesn't have a default URL to fetch. It would be better if, when not given a specific URL to fetch, it was able to fall back to the contents of client.url.
The computing.help hosts
There are currently 5 of these. At present they're designed to be used mainly via http. The problem is the "Search" box. Alastair will look at this problem.