July 18, 2018
When I first got involved in the world of web development some 20 years ago, “security” and “website” were seldom, if ever, used in the same sentence. This was back when Amazon.com only sold . . . books. Now it seems like we buy everything - including groceries - from Amazon. I’ve blown a bit off-course here, but Amazon does serve as one example of the topic at hand: SSLs. If you’ve visited Amazon.com or even Fyin.com (as well as thousands of other sites), you may notice that the URL (web address) starts with https. That S is an indication that the site is secure, which means that the site has an SSL certificate installed.
What is an SSL? The acronym itself stands for secure sockets layer. What it means in layman’s terms is that any information you share on the site (data passing from your browser to a web server) is encrypted and secure. This allows you to shop online and fill out forms with a higher degree of confidence. And if you’re a site owner, it builds trust in your brand.
As of late 2017, Google gave all companies/organizations another reason to care about SSL certificates: Google now downgrades sites that do not have one installed. If you visit a website that does not have an SSL installed, you may see a browser warning like this one:
If your site falls into the “not secure” category, it’s time to fix that. Before contacting your web host/provider about purchasing and installing an SSL, there is an important step you can take to make the process flow smoothly. The installation process requires verification (tying the site to its legal owner). The CA (certificate authority) will send a verification email to the contacts listed in your WhoIs record. However, if you have private domain registration (which is very common), the email verification won’t connect. The CA also sends an email to a set of standard addresses. So, at least one of these needs to exist:
admin@yourdomain.com
administrator@yourdomain.com
hostmaster@yourdomain.com
postmaster@yourdomain.com
webmaster@yourdomain.com
If it doesn’t, you’ll need to set it up as a standalone email account or, more commonly, an alias of an email address that already exists.
Once you’ve cleared that little hurdle, here’s a brief rundown of the SSL process:
- Create a CSR (certificate signing request). The CSR contains information such as your domain name, location, etc.
- Purchase an SSL certificate. There are a few different types of SSL certificates; your web provider will be able to guide you as to which one is the best fit for your site. The cost will vary a bit depending on the type of certificate.
- Once validated (via the aforementioned emails), the issuer will make the certificate available to you via email or direct download.
- Finally, the SSL certificate is installed on the server. Thereafter, site visitors will know that the site is secure and safe.
Data security is more critical than ever, and having an SSL is an important part of the equation.