SSL Https, is it that simple?

Question

Hi,

I'm just setting up an SSL area of a website, and was just wondering... is it as simple as adding HTTPS on the url?

(this is presuming I have a valid certificate of the hosting company?)

Or is there something more to it?

Thanks.

Answer 1

You have to setup the server to allow ssl connections. That includes generating a signed server request. You send this CSR to the cert authority (Verisign etc), and they send you a cert to install on the server. If you are behind a firewall you need to open port 443.

If you don't control the server i.e. shared hosting, there is probably a page in your control panel to do it all for you using a GUI.

Answer 2

When you replace http: in a URL with https: you are asking your web browser to do two things:

• To attempt an encrypted (SSL) connection
• To change which port to use on the remote server if none is specified in the URL

Most web browsers use port 80 for unencrypted traffic and port 443 for encrypted traffic by default. So, the first thing you need is a web server that is listening on port 443. If you are using a hosting company, this is probably already the case or becomes the case when you configure SSL.

You do not have to use port 443 but that is where browsers will be looking when users do not specify a port. You could also force everybody that connects at port 80 to use SSL as well though with the right configuration. That means that ALL traffic to your site would be encrypted.

To get the encryption up and running you generally need three things: a certificate, an encryption key, and a server request (CSR).

How you configure these is extremely dependent on how you are hosting the web server. Most hosting companies have 'control panels' that you log into for configuration. Common ones are Plex and CPanel. If either of those ring a bell you can post more information to get a better answer.

If you are managing the server yourself the big question is whether you are hosting on Windows or Linux. If it is windows, you are most likely going to want to configure IIS (Internet Information Server) while if it is on Linux you are probably going to configure Apache.

If you are using IIS, this link might help:

http://www.petri.co.il/configure_ssl_on_your_website_with_iis.htm

If it is Apache, Byron gave a good link above:

http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html

You can use other web servers. For example, I use nginx:

http://rubypond.com/blog/setting-up-nginx-ssl-and-virtual-hosts

So, I guess the real step one is finding out more about your server. :-)

Answer 3

Once your web server has the SSL cert installed, it is as easy as using HTTPS on the URLs. There are some considerations to be aware of:

• Port 443 must be open between the user and web server. (obvious)
• Browser caching will be reduced to in-memory session cache and not stored on disk. Also, caching proxies in between will not be able to cache anything, since everything is encrypted. This means an increase in load times and bandwidth requirements of the web server.
• When using HTTPS to receive sensitive data, be sure to disallow its use over HTTP. e.g. If you have a page that accepts credit card numbers in a POST, the app should fail validation if it was not done over HTTPS. This can be done in your code or in web server configuration. This prevents a bug or malware from systematically sending sensitive data in the clear without the user knowing.