Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data).

The website is hosted on a shared platform, and I've bought unique IP + SSL certificate at my webhost, they will do the installation.

Next monday the website will be thoroughly tested by an audit company, so I need to be sure everything is perfectly secured. The web application itself and the server are perfectly secured conforming the requirements - it's just the SSL that still needs to be installed.

My questions:

  • Can someone explain to me in short (and in 'human' terms) what happens when an SSL certificate is installed?
  • Does this require extra configuration in the website source code?
  • Does this mean the website can not be reached over http, and only over https?

(Sorry for my noob questions - I'm a designer, not a server specialist..)

Thanks!

EDIT: Since I haven't had any really useful answers yet, let me add some extra explanation:

  • I am not asking how to install a certificate, my webhost is going to do that for me
  • I'm just looking for a basic understanding of SSL technology, since all info I can find on the web is a bit to specialized for my basic knowledge of server technologies.
  • The thing that makes me wonder the most, is that my host told me my site will be accessible both on http & https - so what's the point of the certificate, then?
share|improve this question

4 Answers 4

up vote 3 down vote accepted

Can someone explain to me in short (and in 'human' terms) what happens when an SSL certificate is installed?

Instead of sending information between the server and browser in a form that can be intercepted easily and read by a third party. The data is sent in an encrypted format to help mitigate someone snooping on the traffic.

Does this require extra configuration in the website source code?

No(ish)...

Maybe... If you are doing redirects explicity to http, rather than https within your code.

Also in many browsers you will get warnings if your site is loading things like images via http. As the browser will complain about the mix of https and http.

Does this mean the website can not be reached over http, and only over https?

Typically no, as the server will allow both http traffic and https. But this can be controlled at the server level. This could be achieved at the server level if you have enough control (I won't go into detail here), but it would require you to have more access than you would normally have on a shared server (unless by shared, you mean a virtual server?).

As a general note... please don't take this the wrong way.

If you are soon to be under the scrutiny of a security auditor for a web application (I assume application, rather than flat html due to the ability to load user data)... and you do not have the basic knowledge of SSL, then unfortunately you are likely to fail the audit.

Sorry I do not mean to jump to conclusions, as you could pass... I do not know the specific requirements of your security audit. But talking from experiance with working with security auditors - SSL is only the begining.

Here is a site that can get you started on security: https://www.owasp.org/index.php/Main_Page

But like they say for anything, if you do not have the skills for a particular role, get someone in to help. I wouldn't expect a developer to have the full skills of a designer and vice versa, so perhaps ask a developer friend for help?

share|improve this answer
    
Thanks, exactly the info I was looking for. As for your remark 'ssl is only the beginning': the site has had a previous audit, and all security holes that were spotted have been addressed by a colleague php developer. So in my particular case, the ssl is just the topping on the cake :-) Thanks again! –  ptriek Dec 9 '11 at 15:42
    
Excellent, @ptriek glad it's worked out for you. :-) –  Alex Key Dec 9 '11 at 16:19
    
sorry to bother you again, but you're my best shot: the certificate has been installed, but it's not working. My webhost tells me that 'my application probably doesn't support SSL', and has asked me to set an SSL variable to true in my php code - can you point me in the right direction, i don't have a clue (and google doesn't help me either).. –  ptriek Dec 9 '11 at 17:46
    
Sorry @ptriek I've had a quick search, but unfortunately I won't be of much help as I am a .net developer and not too familer with PHP. However setting a php variable to true sounds a little odd, perhaps if you are using a particular content management system (cms), perhaps there is a setting? –  Alex Key Dec 9 '11 at 19:08
    
I'd recomend opening up another question with this specific query to grab new attention. –  Alex Key Dec 9 '11 at 19:09

What do you mean by "activated"?

If you lack understanding of SSL, it is high time to learn before you are expected to configure a server with it :)

Depending on the webserver you are running on, the procedures will differ.

For an apache web server, significant configuration and human interaction is required to make it work - unless your hoster has offered to do this for you.

For a Windows web server, the actions are more of the point-and-click variety, but you still need to know what you're doing :) While you CAn reach an SSl website over HTTP, this is a very bad idea - it negates much of the advantages of securing the traffic in the first place.

I can tell you right away that you will not be PCI-compliant when you do this on a money-related website (such as a bank).

PCI requirements are pretty strict, and, of course, public knowledge. You may well find that the audit company expects you to be PCI-compliant, even if the web site does not perform payment transactions directly.

The bottom line is that if this is in any way high-rpofile or production-sensitive, get a professional to do these things for you.

share|improve this answer
    
thanks for your answer. let me explain a little more: i'm not going to do this myself, the site is hosted with a reliable hosting firm, and they are going to install the certificate. They told me not to worry, but i'm still a bit worried because i know nothing about SSL - hence my question... –  ptriek Dec 9 '11 at 10:07
    
You do need to worry about this. They will install the certificate for you on their webserver, but the security if your web application is not guaranteed by the presence of an SSL certificate. SSL just secures data between the browser and the server. You are still responsible for how your application works and handles data once it recieves it. Simply having an SSL certificate in place will not be sufficient for most audits. –  dunxd Dec 9 '11 at 11:26
    
@dunxd the web application itself is properly secured (data sanitization, XSS prevention, ...) and server is perfectly configured as stated in the requirements. The only thing that still needs to be done is installing the SSL... –  ptriek Dec 9 '11 at 11:49

As for your last bullet, it's common practice to redirect requests that arrive at the unencrypted site to the encrypted site, like in this example that could be found in an Apache httpd configuration:

<VirtualHost 1.2.3.4:80>
ServerName thesite.example.com
RedirectMatch (.) https://thesite.example.com$1
[...]
</VirtualHost>

Be aware that this redirect is transmitted through the plain HTTP connection and your users are only immune to some specific attacks if they actively enter the https URL into the browser.

share|improve this answer

Does "SSL secures data between the users web browser and your server, by encrypting it" answer your question?

Wikipedia's entry on SSL gives more detail.

share|improve this answer
    
that answers the first bullet of my questions, yes - thanks –  ptriek Dec 9 '11 at 12:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.