There's really no reason these days for not using https.
Only three mirrors work with it right now: sa-update.razx.cloud sa-update.pccc.com sa-update.mailfud.org Could maybe others prepare for it? sa-update seems to happily use https:// mirrors starting from 3.4.0, so there shouldn't be any reason not to update these. Btw I just updated DNS to https too: mirrors.updates.spamassassin.org. "https://spamassassin.apache.org/updates/MIRRORED.BY" Apparently spamassassin.apache.org has had https-redirect for a long time, which broke the old checkSAupdateMirrors.sh script too. Cheers, Henrik