Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hey I'm programming a lot with PHP and I'm building a manager system for my site, it is very important that the manager system would be secured as possible, so I want to add SSL.

I learned in the internet that after you got the certificate and do some configures to the server, you can just add https:// and this page would be secured.

Is that true? I know I need to redirect and it's not mysite.com it's onlt www.mysite.com and all that, but that's all?

And what configures I need to do in my server? Thanks.

share|improve this question

migrated from stackoverflow.com Jan 16 '12 at 17:52

This question came from our site for professional and enthusiast programmers.

closed as not a real question by EEAA, Sven, Shane Madden, sam, Ben Pilbrow Jan 16 '12 at 18:31

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

4  
This is not a programming question. Migrating to serverfault. –  webbiedave Jan 16 '12 at 17:51
    
SSL does nothing for security except prevent sniffing traffic while it's "in flight". Get your server secured before worrying about sniffing attacks. it's far easier to break into a bank vault and steal everything, rather than trying to grab a few bucks out of a bunch of people's hands as they leave the ATM. –  Marc B Jan 16 '12 at 17:51
    
SSL/TLS are point to point encryption of communication data. It's one technique, for instance to prevent man-in-the-middle attacks (such as sniffing wifi communications). To have truly effective security, though, it's only one part (encryption of sensitive database record data, username and password policies, perimeter security like VPN access only, etc. might be some others). It's not a panacea, but often an important step to take. –  Jared Farrish Jan 16 '12 at 17:52
    
Except that now that everybody uses WiFi, it's quite easy to grab those "bucks", Marc B. –  Uku Loskit Jan 16 '12 at 17:53
    
I know what SSL is, I need to defent exactly those things. So back to my Q please, does adding https will encrypt the communication data? Thanks. –  EiTkoCaT Jan 16 '12 at 17:55

2 Answers 2

up vote 1 down vote accepted

SSL does provide increase level of security. But remember the word security is so vast these days that it can fall under a lot of things.

You should use SSL when transmitting the following types of data:

  • Authentication data (e.g., passwords, session cookies)

  • Data that data stewards have classified as non-public

  • Data that needs to be protected from modification on its way to or from the server (e.g., user input or a result set from the server)

It is important to remember that although SSL can protect the flow of information between your server and a web browser, using SSL does not offer any additional system level security.

After setting up the certificate, you will see the HTTPS, check the certificate is correct and valid and you should be good to go.

It will not protect you from various other things including bad programming and lack of data verifications. You should see best practices for PHP security such as http://phpsec.org/projects/guide/ or http://php.robm.me.uk/

You can also improve security by carefully configuring the IIS or Apache with various modules. Ensure latest updates applied and follow best practices.

share|improve this answer

Yes, you got the basics right. You either need to generate a self-signed certificate, or buy one. When that is done you need to configure your web server (not PHP) to offer SSL encryption.

Enforcing SSL is another game. Some applications have toggles to enforce SSL (as in https URL's). If yours can't do that then you'll need to do some re-writing at the web server to make sure that every request goes over a secure channel.

share|improve this answer
    
Rewriting is useless if the application doesn't know it should stay over HTTPS (or uses relative links): it will just create redirections from http:// to https://, so the initial request will still be made in plain HTTP. –  Bruno Jan 16 '12 at 18:21
    
@Bruno So making it https isn't enough? What should I do? I'm using PHP... –  EiTkoCaT Jan 16 '12 at 18:25
    
@EiTkoCaT I was just commenting on the "re-writing" aspect. You should be able to secure the communication to your server by enabling HTTPS, but (a) there are potential vulnerabilities that have nothing to do with this (XSS, CSRF, ...) and (b) when using HTTPS, make sure that all the references you use within a page don't go via plain HTTP (even for just a rewrite/redirect). –  Bruno Jan 16 '12 at 18:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.