Internet security with SSL and HTTPS certificates

Last Updated on February 16, 2017 by Editor Futurescope

Electronic espionage and malicious use of information are problems faced by both international authorities and private consumers. That is why the subject of Internet security is becoming a priority for many companies. Digitization not only takes place in the private sector, but within the workplace more and more companies use online resources to operate their businesses. Current security standards recommend implementing an SSL Certificate or HTTPS certificate to securely transmit and manage customer data or sensitive information for a company. But what exactly do these acronyms mean and how can these security protocols be implemented on the Internet?

What is SSL?

The term SSL (Secure Socket Layers) refers to a technique used for encryption and authentication of data traffic on the Internet. When implemented in web pages, it is ensuring communication between the browser and the web server. For eCommerce, where sensitive and confidential data is transmitted. It is essential to implement an SSL certificate or its successor TSL (Transport Layer Security).

The set of data that is protected by the SSL encryption protocol includes:

• Registration information: name, address, email address, phone number
• Identification data: email address and password
• Payment details: credit card number, bank account
• Registration Forms
• Documents uploaded by customers

The SSL certificate guarantees that the communication will not be read or manipulated and that personal information will not fall into the wrong hands.

What is HTTPS?

The HTTPS (Hypertext Transport Protocol Secure) certificate is also a protocol for secure data transfer. The recognized HTTP is the unsecured version. With this it is possible to read or modify all the data transmitted in web pages and the user cannot be safe, for example, if he actually gave the data of his credit card to the online store or to a hacker. For its part, the HTTPS certificate encrypts the data and authenticates the requests. The HTTPS protocol is based on SSL and its improved version: the TLS certificate. Experts recommend the exclusive implementation of TLS, because when it comes to SSL, it refers to TLS.

Advantages of using an SSL / TLS and HTTPS certificate:

• Privacy and security for customers and partners
• Reducing the risk of theft and misuse of data and information
• Positive impact on Google ranking factors
• Enables the use of HTTP / 2 to improve web performance
• The certificate is recognized by users and inspires confidence.

How to implement an Internet security certificate on a web page?

New web pages may include an SSL or HTTPS certificate since it was created. For existing websites, switching to HTTPS does not require much effort. Also simple to configure. The first step is to get an SSL certificate for the respective domain.

Purchase an SSL Certificate

The SSL certificate is a kind of proof of identity for a web page. The Certification Authority (CA), which assigns the certificates, is responsible for pre-checking the identity and veracity of the information on the website. SSL certificates are stored on the server and requested every time a user visits an HTTPS web page. There are different types of certificates, distinguished mainly by the type of authentication they offer:

Certificates with domain validation (Domain Validated Certificate)

These are certificates with the most basic level of authentication. The Certification Authority verifies only if the applicant is the owner of the domain to certify. The information of the company is not checked, which implies certain risks. Because the authentication process does not require a lot of time, this certificate is usually issued quickly and is also the cheapest of the three types of SSL certificates.

This type of certificates are suitable for web pages where the credibility and trust of users play a secondary role and where there is no risk of phishing or fraud.

Organization Validation Certificates

This type of authentication is broader and, therefore, more secure than the certificate of domain titration. In addition to verifying ownership of the domain, the Certification Authority verifies relevant corporate information, such as its inclusion in the Mercantile Registry. Once verified, such data is visible to visitors to the web, which increases their confidence in the website and in the company. As a consequence of the validation process, this certificate is much more expensive than the domain but offers a higher level of security.

This certificate is suitable for web pages where transactions involving non-sensitive data exchange are carried out.

Extended Validation Certificates

This is the certificate that offers the highest level of authentication. In contrast to the company validation certificate, the company performs a detailed analysis and has strict award criteria, in addition to which it can only be assigned by an Authorized Certification Authority. This is responsible for making a detailed analysis of all aspects relevant to security, thus strengthening the trust and credibility offered by the website. As a consequence, it is the most expensive of all. This certificate is suitable for websites that collect, for example, bank account or credit card data, as well as other sensitive information.

In the following infographic you can check which certificate is the most appropriate for your website:

Installation and configuration

The next step is to install the SSL certificate on the server. It is common for many web hosting providers to take care of it. In the section of customers, it is possible to request the certificate and the supplier will take care of the rest. As a 1 & 1 client it is possible to do so from the Control Panel, where you can add the SSL certificate to the chosen web hosting package. In many packs, the certificate is already included. The installation will vary depending on the supplier, who, in general, always makes available to the user the corresponding instructions for their installation. That the protocol is executed without problems will depend mainly on these aspects:

• Choosing the appropriate certificate
• Correct encryption
• Proper configuration on the server
• Errors and problems during deployment

During the implementation of the protocol there may arise some errors that must be avoided to prevent problems during the ranking in the search engine rankings or when accessing web pages that are not operational.

Web administrators who deploy SSL and HTTPS certificates should:

Avoid expired certificates: An invalid SSL certificate generates a warning message in the browser window. With this, the ideal of transmitting confidence and security to the user is completely lost.

Set up a correct redirection: to avoid duplicate content, webmasters should be careful to ensure 301 redirection of their domains. This prevents search engines from recognizing the HTTP web and HTTPS web as two different pages and expecting different content.

Adjusting ads (Google AdWords, Bing Ads, etc.): If an HTTPS webpage includes unencrypted content (such as images, scripts, etc.), a warning message will appear that will not be very user-friendly. This is especially problematic with ads, as most advertising is usually delivered without encryption, so it is necessary to adapt them if you want to ensure maximum security.

Adapt the Webmaster Tools and Google Analytics: in theory, the HTTP version and the HTTPS are two different webs. The HTTPS version has to be registered in the Webmaster Tools once the security protocol is implemented.

Updating the Sitemap in XML: The site map must also be updated and stored in the Webmaster Tools.

Checking External and Internal Links: Even when 301 redirects prevent faulty links, all internal links must be replaced once the HTTPS certificate is implemented. Depending on how the content is managed in the CMS, a manual modification will be required. For external links you should try, as much as possible, to change those main links (eg to pages with great authority) to their respective HTTPS address.

How can you check if a website has a valid certificate?

When a user visits a web page with a valid SSL certificate, they automatically recognize it in the URL:

https://www.example.com

The “s” in the HTTP protocol means “secure” and indicates that this page uses an SSL certificate. Depending on the type of certificate, other signs indicate that the page is encrypted:

Extended validation (EV) SSL certificate: A web page that has been encrypted with an EV certificate is recognized with a small padlock located in a completely green box in the address bar.

Organization (OV) and Domain (DV) SSL Certificates: Web pages that have an OV or DV certificate are characterized by a small green lock in the address bar.

Invalid SSL Certificate: A web page whose SSL certificate has expired or is invalid, can be recognized with a security lock covered with a yellow warning triangle in the address bar.

Web page without SSL certificate: When a web lacks an SSL certificate, there is no visual indication about a secure connection and, depending on the browser, a warning will appear.

With the free 1 & 1 SSL checker you can check with a single click if your SSL certificate has been correctly installed and protects your page against attacks.

Free SSL Certificate with Let’s Encrypt, https for your web

Google has long announced that having an SSL certificate on your website would be considered as one more factor to take into account when ranking a page.

Soon a stimulation was created by it and many people went to look for SSL certificates for free or paid to scratch some positions to the search engine.

Google wants the internet to be a safe place and for this he has not thought of anything other than affirm all this to try to make people become more and more aware and pass their web pages to this protocol secure.

The truth is that in an ecommerce or online commerce if that makes sense.  Since it is vital to maintain a security and protection of the data of their users, but for informative web pages in principle does not have to be something necessary.

Free or paid SSL certificate?

At first, just after the news, if you wanted to have a website with SSL you only had the option to contact some of the certificates that are sold in many of the hosting companies. These certificates are private companies and have a fairly high price, ranging from € 25 per year to over € 450.

As you can see, they are disproportionate prices for a simple web page that may not bill even that year.

With the passage of time, has emerged a free ssl alternative very interesting and that may be of interest to you.

Let’s Encrypt, free SSL for everyone.

Let’s encrypt is an organization funded by the Linux Foundation with the aim of offering SSL certificates openly to everyone and without having to pay anything for it.

In this way, now everyone can have a famous https in front of their domain and have the green color, which certifies that your web page is secure and all the data entered in it are correctly encrypted and protected.

Advantages of using Let’s Encrypt

• It is totally free.
• It offers a security certificate to your web page.
• You do not need to have a dedicated IP.
• Free renewal every 3 months automatically.
• Very simple installation if your hosting offers it.
• You can enable HTTP / 2.
• Google says that it will favor your positioning in your search engine.

How to install Let’s Encrypt easily?

Actually anyone can use this free SSL certificate, but in order to install it you have to have a series of knowledge unless you use some of the hosting providers that already offer it totally free in their plans of web hosting.

There are currently 2 hosting companies that offer it totally free and you can install it with a single click: crocweb and Siteground.

With both hosting you can request that you install the Let’s Encrypt certificate with a single click. In a few seconds you will have it active and ready to use.

Install Let’s encrypt is very simple with either of these two hosting. If you want to install it on your own server the thing is already complicated and you will have to have knowledge for it or look for someone who does.

How to migrate WordPress from http to https and use SSL

WordPress from http to https

If you are lucky enough to have your website with one of these two hosting or decide to hire them (they make the migration of your web completely free of charge from your old provider), surely you are considering migrating wordpress to https since you can do it totally free.

For this you have to take into account a series of guidelines follow these steps that we show you next

1. Change the url of your site in your WordPress admin. Settings> General> WordPress Address
2. Add in the wp-config.php file of your wordpress the following:

Define (‘FORCE_SSL_LOGIN’, true);

Define (‘FORCE_SSL_ADMIN’, true);

3. Perform a redirection of your old urls to the new ones with https modifying your .htaccess

RewriteEngine On

RewriteCond% {SERVER_PORT} 80

RewriteRule ^ (. *) $ Https://your_domain.com/$1 [R, L]

Modify htaccess

This is very important if you do not want to have duplicate content on your website. You have to redirect all your old urls to the new version of your blog or website.

Remember to change “yourdomain.com” by the real name of your web page.

Search and replace script Lastly, I recommend downloading thiescript to change the urls also in the database. You will save surprises and you will see how absolutely all the urls (internal links, images …) change of url correctly and you do not have any along the way.

Its operation is very simple:

Download the script, unzip it and upload to the root of your worpdress the file: search-replace-db-master (you can rename it with a better name).

Enter the url: www.yourdomain.com/search-replace-db-master (or whatever name you’ve given)

You will see a panel in which the data will automatically come out of your database

Fill in the “Replace” option with your old url and put the new one in “With”

Get the Run.

In a few seconds you will have the job done and your migration completely finished.

You can also do all the steps at once with the Really Siple SSL plugin, but in truth it would install a plugin for some very simple changes that you can do manually, without having to rely on any plugins tomorrow.

The choice is yours, so you decide what to do yourself.

Another thing you should do, if you previously had your page in Google Search Console, is to register your domain again but this time with the https: // in front. Then you must confirm ownership of that domain as you did the last time.

If you have not registered your site in Search Console I recommend you do it, it gives you a lot of information about how your site behaves in Google and helps google to crawl your website and get better indexing.