up vote 2 down vote favorite
share [g+] share [fb]

My website is new and is not a fully ecommerce website. But there is a page(purchase.html) where I would sell some toys. The rest are just like a blog, contain information. If thats the case, do I need to buy a SSL certificate? I mean, is it worth if I purchase it just for 1 page (purchase.html)?

Ok, another question is:

In what circumtanses do we need to buy a SSL certificate?

My server is Windows 2003, using IIS, php and MySql

Well, I am kinda new to it, so please advise me. Thanks in advance.

link|improve this question
feedback

5 Answers

up vote 12 down vote accepted

If you accept credit cards, yes, absolutely, and not only purchase a certificate but be sure you are installing it correctly and writing good, secure code.

If you are just getting started, much better to use a payment gateway (paypal, Authorize.net, etc) which offers a service where they do the actual payment transaction on their server.

link|improve this answer
2  
installing might not be a problem but writing a good, secure code its not very easy. Any tips you can give me? I always use mysql_real_escape_string when execute mysql query – yhao Aug 31 '09 at 3:51
use bound variables, not escaped strings in concatenated queries and values – slovon Aug 31 '09 at 12:33
1  
This site's format lends itself to answering more specific questions, I couldn't cover it all here. Escaping variables by some means is good. There are many other things one can do. There are some good books on the subject. – Devin Ceartas Sep 1 '09 at 2:45
feedback
up vote 3 down vote

You would want an ssl certificate if you transfer any sensitive information to your server. This includes passwords and credit card numbers. If you are going to be handling payment directly on your site, then you want a certificate, but if you are going the route of paypal or the like, then you likely do not need one.

link|improve this answer
feedback
up vote 3 down vote

Check out paypal's shopping cart. (Its free) https://www.paypal.com/cgi-bin/webscr?cmd=p/xcl/rec/sc-intro-outside Let them worry about all the payment related details.

If your using shared hosting, you wouldn't be able directly accept credit cards payments anyway according to the PCI-DSS rules.

link|improve this answer
feedback
up vote 1 down vote

You have not to buy a SSL certificate to secure your payment connection. You could use a self-signed certificate with OpenSSL or sign it by www.cacert.org.

Even with such a self-signed certificate your connection is fully encrypted and secure.

The disadvantage is that your visitor may not trust your certificate cause its not signed by a trustfully third person.

link|improve this answer
feedback
up vote 0 down vote

I recommend you to buy SSL from Trusted CA instead of creating a self signed certificate. You can find SSL Certificates (at normal prices) from some CAs at $9 or even less.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard