SSL Certificate needed for my website?

Question

The website allows users to register (name, email and password). It works like a forum with no e-commerce is involved).

My initial plan was to have a secure part of the site eg. secure.example.com which would hold the register form and login. Is this a good idea or overkill?

Answer 1

It is always considered best practice for all occasions where you are collecting information, for that information exchange to be conducted over an SSL connection (secured with an appropriate certificate).

If you do that over a subdomain of your primary domain, or over an SSL version of your primary domain makes no difference in the overall transaction, just a few redirects or not. How it works is essentially down to your personal preference and how you wish your user flow through your application to operate.

Answer 2

You don't need a subdomain for that, you can just redirect to "https://example.com" for registration/login. You can have the same domain for HTTP and HTTPS without any problems.

And yes, if you handle passwords, you should use SSL. You will also need a valid certificate for your domain.

Answer 3

SSL certificates are very important to encrypt communication between server and client to prevent against man-in-the-middle attacks where they could read or interfere with communications. It also helps build trust between the end user and the website they're using, many users are now familiar with enhanced SSL certificates that will turn the address bar (or part of it) a green colour. These enhanced SSL certificates usually require additional checks by the certificate authorities (CA) before they will grant you the certificate. However these are extra-expensive and I recently got a Geotrust SSL Certificate with good encryption for just 67 GBP (around 100 USD at time of writing).

Don't forget users will often reuse their e-mail address and password on multiple sites and though your website might not contain any confidential information without an SSL certificate you are putting your users at risk if you do not use SSL encryption as an attacker might compromise JoeBlogs and log into their gmail/paypal/whatever. If you literally have no money for an authority issued SSL certificate then you can self-sign a certificate, this will generate a warning for your users but at least if they agree the communication will be encrypted!

On the issue of only encrypting some parts of the site you have to be careful... I have recently secured one of my sites to being dedicated to SSL including transmitting cookies over SSL. Otherwise it's technically possible for an attacker to take over a user session when they are using the HTTP portion of the site.

Answer 4

SSL is cheap.
Lawsuits may cost you millions.
There's an easy choice.

Just make the entire site secure, and don't bother with the secure.xxx stuff, there's not really a lot of point from a technical point of view, unless that is going to be explicitly handled by a different server.

Seriously, you can pick up a suitable SSL certificate for like $12 from various rapidssl resellers. Not only are you protecting the username/login details, but also any HTTP session information stored in a cookie, because the cookie transactions will also be SSL encrypted.