I had never used https on a site and now want to try it. I did some research, but not sure that I understood everything. Answers and corrections are greatly appreciated.

Here we go:

  1. To use https I need to generate ‘private’ and ‘public’ keys for the web server I use. In my case it’s apache (manual: http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html)

  2. Https protocol should be bound to port 443.

    Q: How to do it? Is it done by default? Where can I check configuration?

  3. Aplying https.

    Q: If I see https in browser does it mean that the data traffic on the page IS encrypted? Any form on the page would submit data via https?

  4. Though all the data gonna be encrypted, the browsers would still show ugly red messages. This is just because they do not know anything about my certificate. They have about a hundred certificates pre-installed but mine is not one of them, obviously. But the data IS encrypted by https.

  5. If I want browsers to recognize my certificate, I would need to have it signed by one of the certification authorities (ca) that has its certificate pre-installed (e.g. thawte, geotrust, rapidssl etc).

UPD: To read about ssl/tsl: The First Few Milliseconds of an HTTPS Connection, I found it very informative. PHP code examples of how to make use of ssl/tsl cryptography on the server side are published here.


Answers (kind of):

  1. No : you need to generate SSL certificate and a private key (the public key is embedded in the certificate) : assuming X509 certificates
  2. Yes : generally speaking it is a good idea. For example: when you install mod_ssl module to apache server is by default configured to use port 443. For any more pointers look into configuring Apache and mod_ssl.
  3. Yes : to be more precise : the traffic between your browser and the server IS encrypted unless you leave the page (whatever 'page' means in this case is defined in the configuration on the server : again look at Apache configuration).
  4. The browser usually will ask you to add 'exception' to its SSL connection rules. That happens because your browser does not trust trust the certificate of your server. To be more precise it does not trust it because it is not signed by any CA (Certificate Authority) that is trusted by your browser (so called 'chain of trust').
  5. Yes and No. If you want that all browsers installed by all users on this planet to trust your server: YES. If you want just your browser to trust it: NO : you can always configure your own browser to trust your particular server.

I hope that helps. I know that many of the things I wrote may be not precise enough, but I don't know how broad your current knowledge on the subject is.

  • Thank you. Now I am gonna be more confident with https implementation. Sure this will be useful for others who consider https (ssl/tsl) protection. Sep 18 '12 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.