Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website is new and is not a fully ecommerce website. But there is a page(purchase.html) where I would sell some toys. The rest are just like a blog, contain information. If thats the case, do I need to buy a SSL certificate? I mean, is it worth if I purchase it just for 1 page (purchase.html)?

Ok, another question is:

In what circumtanses do we need to buy a SSL certificate?

My server is Windows 2003, using IIS, php and MySql

Well, I am kinda new to it, so please advise me. Thanks in advance.

share|improve this question
up vote 12 down vote accepted

If you accept credit cards, yes, absolutely, and not only purchase a certificate but be sure you are installing it correctly and writing good, secure code.

If you are just getting started, much better to use a payment gateway (paypal,, etc) which offers a service where they do the actual payment transaction on their server.

share|improve this answer
installing might not be a problem but writing a good, secure code its not very easy. Any tips you can give me? I always use mysql_real_escape_string when execute mysql query – yhao Aug 31 '09 at 3:51
use bound variables, not escaped strings in concatenated queries and values – slovon Aug 31 '09 at 12:33
This site's format lends itself to answering more specific questions, I couldn't cover it all here. Escaping variables by some means is good. There are many other things one can do. There are some good books on the subject. – Devin Ceartas Sep 1 '09 at 2:45

You would want an ssl certificate if you transfer any sensitive information to your server. This includes passwords and credit card numbers. If you are going to be handling payment directly on your site, then you want a certificate, but if you are going the route of paypal or the like, then you likely do not need one.

share|improve this answer

Check out paypal's shopping cart. (Its free) Let them worry about all the payment related details.

If your using shared hosting, you wouldn't be able directly accept credit cards payments anyway according to the PCI-DSS rules.

share|improve this answer

You have not to buy a SSL certificate to secure your payment connection. You could use a self-signed certificate with OpenSSL or sign it by

Even with such a self-signed certificate your connection is fully encrypted and secure.

The disadvantage is that your visitor may not trust your certificate cause its not signed by a trustfully third person.

share|improve this answer
The asker was obviously new to SSL and even writing secure code. How about advising them to get a free certificate, which won't spook their users? – Dan Dascalescu Feb 11 '13 at 10:47

I recommend you to buy SSL from Trusted CA instead of creating a self signed certificate. You can find SSL Certificates (at normal prices) from some CAs at $9 or even less.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.