Data espionage and data misuse are serious problems for both international authorities and consumers worldwide. Internet security is thus occupying an increasingly central role for both businesses and individuals. There’s little doubt that the Information Age has substantially affected the way we interact with one another on both a private and professional basis. In-house communication, customer data, and other sensitive information build up some of the most vital nuts and bolts of this infrastructure, and protocols like SSL/TLS i.e. HTTPS are vital to ensure their secure management. But what exactly do these terms mean and how does one go about implementing security protocols for their web presence?
What is SSL/TLS?
The term SSL (short for “secure socket layer”) describes a technique for encrypting and authenticating data traffic on the internet. With regard to websites, the transfer between the browser and webserver is secured. Especially when it comes to e-commerce and online banking, where plenty of confidential and sensitive information is routinely transferred between different parties, using a SSL certificate or a TLS (“transport layer security”) certificate is simply unavoidable.
Here are some examples of types of sensitive data that should be protected by SSL/TLS encryption:
- Registration data: names, addresses, email addresses, telephone numbers
- Login data: email addresses and passwords
- Payment information: credit card numbers, bank details
- Data entry forms
- Customer documents
Using SSL/TLS helps keep communication safe from those looking to snoop into or manipulate personal data.
What is HTTPS?
HTTPS (“hypertext transport protocol secure”) is the protocol used for secure data transfer, whereas HTTP refers to the non-secured variant. With HTTP websites, all transferred data can potentially be read or changed by attackers, and users can never really be certain whether their credit card data has been sent to the intended online vendor or a hacker. HTTPS encrypts data and verifies the authenticity of requests. This process takes place via the SSL certificate or the more sophisticated TLS certificate. In other words, it is the combination of HTTP and SSL/TLS. Most experts agree that TLS should be used in place of SSL. Sometimes the terms get used interchangeably even though TLS is meant.
The advantages of using SSL/TLS and HTTPS at a glance:
- Data protection and security for customers and partners
- Minimised risk of data theft and abuse of personal information
- Positive ranking factor on Google
- Enables use of HTTP/2 for improved website performance
- Certificates are easy for users to recognise and help to build trust
Free vs Paid SSL/TLS: free or paid certificate?
To switch your website to SSL/TLS, you will need a SSL/TLS certificate. Ever since they were launched in 2015, non-profit organisation Let’s Encrypt has been providing a free, easy-to-install alternative to the classic, paid certificates. So when converting a website to HTTPS, you now have the choice between free or paid SSL/TLS. But you should be aware that free version certificates tend to be used increasingly by criminals to create more trustworthy phishing websites – sites that resemble reputable websites at first glance. Note
At the beginning of March 2020 Let’s Encrypt had to withdraw more than three million of the active SSL/TLS certificates. The reason for this was an error in the open source software Boulder used by Let’s Encrypt, which was caused by the verification of CAA records (Certification Authority Authoristion). In theory, this error made it possible to have certificates created for other domains. The only solution for those affected: Within 24 hours a new certificate had to be generated so those affected could restore the encryption of their own project.
In general, the following features distinguish free from paid SSL/TLS certificates:
- Validity: The main difference between free and paid SSL/TLS is the duration of time they’re valid for. Whilst most paid certificates are valid for 12 to 24 months, free certificates usually expire after 90 days at which point they need to be replaced.
- Maintenance: Choosing a paid certificate, you’ll get all the tools to manage and maintain it. Unless you buy add-ons, you won’t get that kind of service with a free SSL/TLS certificate which may require more hands-on administration.
- Domain association: A free SSL/TLS certificate can only ever be created for a single domain which it is tied to. If you’re choosing a paid SSL/TLS instead, you can benefit from domain-overlapping certificates that can be applied to multiple web projects.
- Address bar presentation: When you select a paid certificate, you can usually indicate this as part of your web address in the browser bar. Free SSL/TLS certificates are marked as HTTPS projects, but can’t be personalised to your website or company name.
Want to switch to HTTPS? Protect your domain with low-cost SSL/TLS packages from UKBSS.COM!
Converting websites to HTTPS: the most important steps
Developers have the option of configuring a SSL/TLS encryption for newly developed websites, and there are even options available for changing existing pages to HTTPS without much effort. The first step is the same for both scenarios and involves acquiring the SSL certificate for the corresponding domain.
Obtaining the SSL/TLS certificate
An SSL certificate is a kind of website ID obtained through an official certification authority or CA. The CA’s responsibilities include confirming the certificate’s identity as well as vouching for its authenticity. SSL certificates are deposited on the server and accessed whenever a website with HTTPS is visited. There are different kinds of server certificates that vary in their identification:
- Certificates verified by domain validation (DV) – free and paid
These certificates have the lowest authentication level. For this measure, CA only checks whether the applicant owns the domain for which the certificate is to be issued. Company information is not checked during this process, which is why some residual risk remains with domain validations. Because there is only one factor that needs to be verified, certificates are normally set up quickly by the CA, making it the least expensive of the three SSL certificate types. Often, these are entirely free (Let’s Encrypt).
Certificates with domain validations are best suited to websites that rely less on their security reputations and are known for being free of fraudsters or phishing schemers.
- Certificates verified by organisation validation (OV) – paid
This kind of validation provides more comprehensive authentication. In addition to domain ownership, the CA examines relevant information, such as company filings. Information that has been vetted by the CA is accessible to website visitors, which boosts the site’s transparency. The somewhat demanding nature of this certificate means that it can take longer and be more expensive to issue this kind of SSL certificate. What users gain, however, is a higher level of security.
This certificate is best suited to websites where low-level security transactions take place.
- Certificate verified by extended validation (EV) – paid
This certificate has the highest and most extensive authentication level. In contrast to certificates verified by organisation validation, this process requires company information to be even more thoroughly scrutinised. What’s more, this certificate is only issued by CAs authorised to do so. This exhaustive review of the company achieves the highest security level of any certificate and additionally increases the website’s credibility. Following this, this certificate is also the most cost-intensive of the three.
This certificate is ideal for websites that deal with credit card information or other sensitive data.
The following infographic may help you to assess which SSL/TLS certificate you need:
Installation and configuration
The next step involves installing the SSL/TLS certificate on the server. Hosting providers often take care of this step. The customer area of the provider’s site allows users to directly apply for the required certificate, which is then added by the provider. As an IONOS customer, you can easily add a SSL/TLS certificate to your existing webhosting package by following the steps in the Control Center. For many packages, the certificate is also included and installation varies depending on the provider. Generally, providers or certificate vendors supply the corresponding installation guides. The following points are essential for a seamless installation:
- Correct certificates
- Proper encryption
- Appropriate server configuration
Errors and problems when changing to HTTPS
Some mistakes should be avoided when converting a web presence. Heeding this advice can save you the trouble of having to deal with ranking losses or unavailable sites.
Website owners wishing to switch their sites to SSL/TLS should, therefore:
- Avoid expired certificates: an invalid or expired SSL certificate can lead to warning messages appearing in the browser window. This sends the wrong message to the user and can potentially reduce website traffic.
- Setting up the correct redirect: avoiding duplicate content requires the webmaster to set up the correct 301 redirect. Doing this helps search engines avoid the pitfall of evaluating the HTTP site and the HTTPS site as two different websites and expecting different content from them in the process.
- Aligning advertising accounts (Google AdWords, Bing Ads etc.): embedding unencrypted content (pictures, script, etc.) into an HTTPS site causes a warning message to appear when the user accesses the website, which can unnerve them. This can particularly lead to trouble when placing ads, as most advertisements are dispatched in unencrypted forms, making it all the more important to ensure that your accounts have been properly aligned.
- Converting Webmaster Tools and Google Analytics: in theory, HTTP and the HTTPS version are actually two different websites; this is why the HTTPS variant also needs to be registered in the Webmaster Tool.
- Updating XML Sitemaps: the sitemap also needs to be updated and recorded in the Webmaster Tool.
- Checking external and internal links: Even though 301 redirects may prevent corrupted links, all internal links should still be changed after migrating to the HTTPS protocol. Depending on how the content is added to the CMS, carrying out this step manually may be an unavoidable chore. For external links, it’s best to adjust the most important links (e.g. those with significant page authority) to the new HTTPS address.
How are sites inspected for valid certificates?
Websites that are encrypted with a valid SSL certificate can be recognised as such by their URL:
The “s” in the URL’s HTTP protocol stands for “secure” and notifies users that the site is encrypted with an SSL/TLS certificate. Depending on the type of the certificate and the browser, there are also other visual cues that refer to secure encryptions: