More
SSL Installation: In A Nutshell

SSL Installation: In A Nutshell

22-01-2014 10:40:19

As a whole SSLGURU.com always tries to provide the most update security advice to our clients, so today we are going to discuss some of the duties that content owners and publishers have in order to properly store and transmit their customer’s data. It has been proven that if a customer believes that their data is safe then they will be more inclined to shop and spend online. In order for industry standard s to improve it is important that website protection is “vendor-neutral, easy to implement, and globally accessible.” Every website owner should integrate the best security practices into the web design and implementation and this includes the use of SSL.

 

The Two Biggest Myths of SSL.

Many companies choose not to always have their SSL on because of the common misunderstanding that SSL is relatively expensive and can increase the overhead of the website. On a website that has a high volume of traffic the common misunderstanding is that always having your SSL on will increase the computational load because encryption requirements. However researchers at Google performed extensive research and found that for their high-volume sites, there was for additional hard-ware to implement SSL that was always on.

 

The second Myth of always having your SSL on is the substantial decrease of your network’s performance. Because of the complexity of the SSL handshake the network will experience latency “especially over long distances, or in areas where network bandwidth is limited, as well as on sites where users initiate a lot of very short SSL/TLS sessions. However, network performance can be managed by proper planning and by following the rules and regulations set forth by Google’s SPYD (An experimental Protocol for a Faster Web) program.

 

How To Properly Install Your SSL Certificate.

 

All sites built from 2014 on should always use HTTPS protocol as a default, “and always redirect HTTP connection requests immediately to HTTPS, especially for web forms.” And for the designers that choose not to integrate before production, even though it may be a little bit more expensive to implement after production, the cost will be relatively minor. Below is a check list for the proper steps to enable SSL.

 

1.       Install an SSL certificate from a Trusted Certificate Authority. Here is a link to the most trusted SSL Certificate Brands.

2.       Configure your Server to enforce a minimum key strength of 128/256-bits by using a 2048-bit key length.

3.       Double check and make sure that you installed the full certificate chain, including the intermediate to Root CA

4.       Disable access via Port 80 during the test phase.

5.       Set the Secure Flag for all session cookies.

6.       Check all your pages for non-secure connections back to the site.

7.       Avoid mixed content on your pages, and do some Manuel testing to find any remaining places where content is accessed via port 80.

8.       When all the port 80 accesses have been closed off, you can re-open port 80 and have it always redirect to port 443.

 

Final Thoughts

Following the protocol above will hopefully give you the guidelines you need to successfully install your SSL certificate. Nevertheless it is important to make sure that all hyperlinks that are used on your site are coming from a secure source. If the hyperlinks are not coming from a secure source it should be standard protocol to block them completely unless approved by compliance. I would recommend this protocol because any major browser will warn the user, and more importantly it is an insecure coding practice that is going to be addressed in the upcoming browser updates. If you take the advice above your company will not be the only one, major players in the industry including Twitter, Facebook, Microsoft, and Symantec have all been advocating the use of SSL. For more information about SSL certificates please visit www.sslguru.com. If you have any questions about the certificate authorities (GeoTrust, Thawte, DigiCert Etc.) or what certificate will best fit your site (Single Domain, Wildcard, Multi-Domain Etc.) feel free to call us at 1855-SSLGURU.

 

Source: Wikipedia/Icannwiki/IBM/Chromium/SSLGURU

Recent Posts

Comodo / Sectigo is changing its Root CAs
28-12-2018 11:23:52

Sectigo, formerly known as Comodo CA, is entering the next phase of its transition: it’s replacing Comodo CA roots with USERTrust roots on January 14, 2019. Why it happens and what it will mean to Sectigo customers?

Comodo / Sectigo is changing its Root CAs
Comodo is now Sectigo
09-11-2018 12:54:30

According to previous announcements, a year after the acquisition of Comodo Group by Francisco Partners, on November 1 Comodo CA announced that from now on it is changing its brand to Sectigo [pronounced. sec-tee-go]. The goal of rebranding is consistency in company communication and better dedication to what Comodo is doing now.

Comodo is now Sectigo
European Cyber Security Month 2018
27-09-2018 10:46:21

The European Union Agency for Network and Information Security (ENISA), which is the center of knowledge about cyber security in Europe, organizes as every year in October the European Cyber Security Month. The campaign is starting in a few days. What is its purpose and how can you participate in it?

European Cyber Security Month 2018
more posts

cyber_Folks S.A. – Cookie settings

Do you like good cookies? We too! Some cookies are required for the website to function properly. Also accept additional cookies related to service performance, social networking and marketing. Cookies are also used to personalize ads. Thanks to them, you will get the best experience of our website, which we are constantly improving. The consent granted voluntarily may be withdrawn or modified at any time. More information about the cookies used can be found in our privacy policy. If you prefer to specify your preferences precisely - see the types of cookies below.

Functional (always active)

These are cookies that are necessary for the website to function. The website will not function fully properly without accepting these types of cookies. Example: A cookie that saves your consent or objection is needed so that we know if we have your consent for certain actions on the website, they will also allow you to log in to the Customer Panel, place an order or contact us via chat.

Analytical and performance

They will make it possible to collect information on how to use the website. These files will allow us to count visits and traffic sources to our site, so we can measure and improve its performance, as well as find out which pages are the most and least popular, and understand how visitors navigate our site. They help us analyze website performance and collect synthetic information. Example: We can make heatmaps, so we know which content is readable and which is not, and this allows for better website design. Thanks to them, we can also see which blog entries were read more often and which less often, which allows us to develop more interesting content. The main tool we use is Google Analytics.

Social

It is social platform cookies that will enable you to be associated with your social media accounts. You can share content from our website there. Social network files (from third parties, such as Facebook) collect information to provide personalized advertising content. For example: Ads on your social media are better suited to you and you reduce the chance of seeing excess ads for already purchased services or products.

Marketing

These are files related to the operation of marketing automation systems and ad accountability. Thanks to them, we limit, for example, the number of views of a given advertisement. They also allow us to perform comparative tests, thanks to which we constantly improve the operation of our website. By testing multiple page layouts, it is easier to get one that provides the best readability for users. Communication also becomes more personalized. For example, we may give you an article on how to find a domain name when we see that you are looking for a domain and it is difficult for you to find a suitable name. We can also, for example, show you a hint about logging in, if we see several unsuccessful attempts in a row. Based on the information from these cookies and activity on other websites, your interest profile is built. We mainly use the Google and Facebook advertising network.