SSL / TLS

Secure Socket Layer (SSL) is an antiquated technology that has been superseded by Transport Layer Security (TLS); however, because both technologies are very similar, TLS is often referred to by misnomer as SSL.

SSL is a layer of encryption that resides on your hosting server in the form of a certificate issued by an organization called a Certificate Authority ("CA"). A CA is a trusted entity who may issue digital security certificates.

How does SSL work?

When a client connects with your server (or your website), if a secure connection is requested your server responds to the client with its issued SSL certificate. Because valid SSL certificates are signed by an authorized Certificate Authority, the client's computer is able to verify the validity of the SSL certificate automatically. The client then uses the keys contained within the SSL certificate to form an encrypted connection with your server. From that point, any information sent from the client to your server (or vice-versa) is sent over the encrypted connection.

What is SSL used for?

There are a few primary uses for SSL in the modern world. The first is to ensure that all connections between clients and your server are secured by point-to-point encryption. This encryption ensures that any malicious observers to the client's traffic are unable to monitor or potentially exploit any information that the client shares with your server. In the case of eCommerce and storefront websites, SSL is required for all transactions as per PCI regulations.

SSL is also used as a form of validation for websites. As part of the SSL issuance process, the Certificate Authority who signs and issues the SSL certificate will verify that the SSL certificate being issued matches the domain name of your website. Once your SSL certificate is installed, a malicious individual would be unable to impersonate your website with a faked SSL certificate.

Because of this, most search engines will give higher page rank to websites who have a properly installed SSL certificate because the search engine can automatically verify that the website is who they claim to be. This is one aspect of search engine optimization.

Types of SSL Certificates

SSL certificates come in a few different forms. This section will break down the different forms of SSL certificates. Regardless of the individual benefits provided by each SSL type, full point-to-point encryption is provided by all forms of SSL Certificates.

Domain Validation

Domain Validation (DV) SSL certificates are the most basic form of SSL certificates available. Because part of the Certificate Authority's issuance process is to ensure that the SSL certificate is being issued to a website with a given domain name, the website's SSL certificate can be used to ensure that the website is who they claim to be.

Extended Validation

Premium or Extended Validation (EV) SSL certificates are more advanced certificates that conform to the extended validation guidelines defined by the Certificate Authorities. The issuance process for an EV SSL includes a more strict vetting process than the DV SSL issuance.

EV SSL are typically recommended for businesses or websites who, by nature are more prone to phishing, scamming, and other fraudulent activities. High risk websites include any website which handles large financial transactions, popular retail stores, and any business which has a higher likelihood to be targeted by Internet fraud.

Which SSL do I need for my website?

If your website handles a large amount of financial transactions, or your business is prone to attract scammers looking to harm your customers, an EV SSL is a better fit for you. On the other hand, if your business just needs an SSL to protect basic financial transactions, or you are looking for the search engine boost from domain validation, the DV SSL will offer you the tools you need at a lower cost than the EV SSL.

Is a SSL Certificate required for my website?

If your website handles any information which is regulated by the PCI board or information may classify as sensitive information then an SSL certificate is required to protect the information handled by your website while in transit.

While websites which do not fit this classification may not need an SSL certificate, we generally recommend all of our customers to have at the very least a DV SSL Certificate to boost their search engine ranking.

To purchase a SSL certificate for your website, please visit Archonix Tech.

Archonix Tech