Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -4 down vote favorite

HTTPS stands for HTTP Secure and is a combination of HTTP and SSL/TLS (Secure Sockets Layer/Transport Layer Security) and is used to provide an encrypted connection to a website.

I understand the need for installing SSL certificates and enabling HTTPS on SAAS environments (on-demand) which host public facing websites or enterprise software.

If a customer's software is hosted on their own server infrastructure (on-premises), obviously behind their own corporate firewall, why would they need to have an encrypted connection to their software?

share|improve this question
4  
do you trust all your users ? – Sirex Dec 16 '11 at 9:47
Plus for for example more modern windows infrasctrcture this is part of the core OS functionality if yuo are smart enough to nenable and install it. – TomTom Dec 16 '11 at 9:48
I don't trust users. I just wanted to know what reasons would require the use of SSL in in house servers. – Nanda Dec 16 '11 at 11:07
Can the downvoters please leave a comment as to why they think this is not a valid question? – Nanda Dec 16 '11 at 11:09
If you don't trust your users, how is this a question? If you have clear text traffic on your network, any user with physical access to the network can sniff whatever they can access. – Doug Dec 16 '11 at 13:12

closed as not a real question by symcbean, womble, splattne♦ Dec 16 '11 at 11:26

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

3 Answers

up vote 4 down vote accepted

Obvious reasons are:

  1. most computer fraud is carried out by employees of the organisation, not 3rd parties

  2. SSL may be used to authenticate the user

  3. SSL authenticates the server and protects against re-routing attacks

  4. SSL will also protect against trojans trying to sniff network traffic (obviously won't provide protection against a trojan which compromises the browser though)

  5. it's cheaper to build in support for SSL when the system is imlpemented rather than add it later when the application is made more widely available

share|improve this answer
up vote 2 down vote

why would they need to have an encrypted connection to their software

Because not everyone in a workplace is entitled to see every piece of data. Login credentials should always be secure, of course, as should certain types of other data - your payroll details might be a good example, or patient details in healthcare or student information in an educational environment are two other examples I can think of easily.

share|improve this answer
Don't authorization mechanisms provide people from accessing unauthorized parts of the application? And also does it not require some kind of software to view unencrypted data, which would anyway be prevented from being installed on those servers? – Nanda Dec 16 '11 at 11:05
2  
kishor, it is trivial to use a network sniffer on a network to capture unencrypted data as its being transmitted, including usernames and passwords. You don't need to do anything to the server to do this. – RobM Dec 16 '11 at 11:19
up vote 1 down vote

Some pieces of software also may require https protocol for authentification for example

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.