2

One networking expert posted a video today in Facebook saying that a government website (which is a subdomain of kerala.gov.in) has no SSL certificate installed. That website is actually just for informative purpose. I mean displaying some information to the public, with no confidential data (passwords, contact information, sessions, payments, etc.) communicated between the client and the server.

So I commented that it is not mandatory for such a simple informative website to have the SSL certificate as there is no confidential information transmitted. But another expert replied to my comment with an insult. I know that I am not an expert and I have limited knowledge. And I know that Google Chrome and some browsers will show not secured in the addressbar if the website doesn't have an SSL and this has forced many website owners to install the SSL even when they are having just a single webpage with some informative text only.

So I deleted my comment and messaged him through chat, to learn about why he posted an insult/objection to my comment. His response was:

SSL is an absolutely necessary way when a Government site wants to show its domain and URL. Because, anyone can host a site and a domain (or spoof a domain) without a SSL.

It is not just about personal data or business transactions. It is more about the authenticity of the site.

I told him that the TLD gov.in is not available for the public to purchase, so if someone sees the website address with this TLD, they can easily identify that its a government website. And he replied this:

SSL is important. Regarddless of being a subdomain of any gov domain.

In internet, there is nothing like 'just some information' and 'serious information'.

For eg. It may take very little time for me to access the internals of that site. It's a flower game for any experienced hacker.

SSL also make it safer and easier to allow authenticated remote maintenance.

So, what I understood from his response is that, the SSL certificate will let the people know that its an authentic website. But actually the use of SSL certificate is to encrypt the communication, isn't it? Though it does domain ownership verification, should it really be mandatory to have the SSL installed for a website that just displays some content?

Btw, the state data center where these government websites are hosted, has strict firewalls and rules, which would prevent remote maintenance of the website. That is, inorder to do any maintenance of the website, you need to be physically present in the data center. I don't have personal experience with these servers, but heard only through some articles.

Am a bit confused here regarding his comments. Kindly shed some light. It would really help me understand & learn more. Because two articles which I referred to double check this info, wasn't providing any extra info other than what I said to him.

Thank you.

closed as off-topic by joeqwerty, Sven Oct 6 '18 at 17:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Sven
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question is far too broad to answer. "Government" is too generic and vague of a term. – joeqwerty Oct 6 '18 at 17:30
  • @joeqwerty, Its a website of kerala government, where they display information about the weather, precautions to be taken during severe weather conditions, etc. Let me know if you need any other information. Or else, if this question doesn't fit in this community, please feel free to move to the respective community. Thank you. – Akhilesh B Chandran Oct 6 '18 at 17:34
  • This is quite a broad topic. However, without EV certificates, everything TLS guarantees (to a degree, under certain conditions) is that the traffic between the server and client can't be read or altered. There is no implied guarantee about an actual identity behind the server or that it isn't compromised. – Sven Oct 6 '18 at 17:35
  • 1
    In my view, a disaster prevention site should be kept as secure as possible. Imagine someone manages to alter the traffic in transit and changes a recommendation that in case of a flooding, location X should be used as shelter to location Y, that in reality is a deathtrap during a flood. – Sven Oct 6 '18 at 17:40
  • 2