One networking expert posted a video today in Facebook saying that a government website (which is a subdomain of
kerala.gov.in) has no SSL certificate installed. That website is actually just for informative purpose. I mean displaying some information to the public, with no confidential data (passwords, contact information, sessions, payments, etc.) communicated between the client and the server.
So I commented that it is not mandatory for such a simple informative website to have the SSL certificate as there is no confidential information transmitted. But another expert replied to my comment with an insult. I know that I am not an expert and I have limited knowledge. And I know that Google Chrome and some browsers will show
not secured in the addressbar if the website doesn't have an SSL and this has forced many website owners to install the SSL even when they are having just a single webpage with some informative text only.
So I deleted my comment and messaged him through chat, to learn about why he posted an insult/objection to my comment. His response was:
SSL is an absolutely necessary way when a Government site wants to show its domain and URL. Because, anyone can host a site and a domain (or spoof a domain) without a SSL.
It is not just about personal data or business transactions. It is more about the authenticity of the site.
I told him that the TLD
gov.in is not available for the public to purchase, so if someone sees the website address with this TLD, they can easily identify that its a government website. And he replied this:
SSL is important. Regarddless of being a subdomain of any gov domain.
In internet, there is nothing like 'just some information' and 'serious information'.
For eg. It may take very little time for me to access the internals of that site. It's a flower game for any experienced hacker.
SSL also make it safer and easier to allow authenticated remote maintenance.
So, what I understood from his response is that, the SSL certificate will let the people know that its an authentic website. But actually the use of SSL certificate is to encrypt the communication, isn't it? Though it does domain ownership verification, should it really be mandatory to have the SSL installed for a website that just displays some content?
Btw, the state data center where these government websites are hosted, has strict firewalls and rules, which would prevent remote maintenance of the website. That is, inorder to do any maintenance of the website, you need to be physically present in the data center. I don't have personal experience with these servers, but heard only through some articles.
Am a bit confused here regarding his comments. Kindly shed some light. It would really help me understand & learn more. Because two articles which I referred to double check this info, wasn't providing any extra info other than what I said to him.