Secure Sockets Layer (SSL) is a cryptographic protocol that provides communications security over the Internet.

learn more… | top users | synonyms (2)

65
votes
5answers
9k views

How do I transition to SSL without affecting PageRank?

Here at Stack Exchange we're working on moving all traffic to SSL. The reason we're not doing logged-in-users only is that one side of the login divide would suffer a redirect from Google every time. ...
26
votes
5answers
2k views

Are the different types of SSL certificates a bit of a scam?

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm ...
22
votes
4answers
3k views

Is using only https bad in a SEO perspective?

I would like to set up a new business site. I plan to direct www.example.com to example.com and only use that domain. My plan is also to only use https and not http. Does this affect the SEO for the ...
19
votes
3answers
3k views

What are the benefits of a more expensive SSL certificate?

I've been comparing prices of different SSL certificates and found a massive difference in prices between different providers. If we take ...
16
votes
6answers
20k views

Is unique IP address a must for SSL?

The shared hosting company told me that if I buy an IP address then it will be applicable for the addon domains too. What does it mean? Then the SSL certificate won't work since there will be more ...
16
votes
6answers
13k views

Why is godaddy HTTPS/SSL certification so much cheaper than digicert, thawte, and verisign?

I am a novice on HTTPS/SSL but GoDaddy charges $12.99 and Digicert, thawte, and Verisign charge $100-1000+ for SSL certificates. I must be missing something on the quality of the encryption or ...
14
votes
2answers
11k views

Is there a way of using HTTPS with Amazon's CloudFront CDN and CNAMEs?

We use Amazon's CloudFront CDN with custom CNAMEs hanging under the main domain (static1.example.com). Although we can break this uniform appearance and use the original ...
14
votes
5answers
554 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
14
votes
2answers
464 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
13
votes
1answer
584 views

Cost of using SSL

I am wondering on the cost of using SSL sitewide. It would be for a standard LAMP site. I know that this will be dependent on the many factors but, can some give me an 'average' or 'guesstimate!'. By ...
13
votes
3answers
18k views

IIS 7 Require SSL automatically redirect to https://

I've configured IIS 7 to require SSL. I'm wondering if I can automatically redirect non-ssl requests to be encrypted. For example, if a user types in http://domain.com, can IIS redirect the request ...
11
votes
2answers
187 views

Choosing which domain to secure

We've got a website that is served on both www.example.com and just example.com - we've never done any sort of forcing users from one domain to the other, so if they land on example.com then that's ...
10
votes
5answers
2k views

HTTPS for entire site

I'm working on a fairly standard web site with public content plus personal/customized content for registered users. I know I need to use HTTPS when users are logging in or sending credit card ...
10
votes
6answers
633 views

SSL certificate provider

I need a SSL certificate for a new site I'm building and I have to choose a SSL provider. What to look for when choosing and what's your experience dealing with them? Thanks!
10
votes
4answers
574 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
10
votes
1answer
672 views

Is it really a security problem to have non secure assets on an ssl page?

My understanding is that this is just an example of being overly cautious, but if my checkout form contains an unsecure asset on it, that doesn't endanger anybody's credit card numbers from being ...
10
votes
2answers
1k views

Using wildcard certificates for multi-server deployment

Currently we are deploying a beta API for our services and we want that all request/responses from the API works over https. I'm confused about using wildcard certificates for both api and www urls. ...
8
votes
2answers
24k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
8
votes
2answers
265 views

Can I use the same SSL cert for HTTPS and FTPS

I am looking to get an extended SSL certificate for a server that is handling one of my subdomains. Can I use the same certificate for https://sub.example.com and ftps://sub.example.com, assuming that ...
8
votes
2answers
3k views

How to serve static content without https in a secure site?

I want to serve static content from my site but my site is https-only. My static http server only serve http content (non https) but many IE users are complaining about being unable to log into. What ...
8
votes
4answers
556 views

free SSL certificates?

how comes that some SSL certificates are free ? What does that mean ? Are they secure or not ?
8
votes
2answers
183 views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
8
votes
3answers
3k views

Forcing SSL and www in .htaccess

I'm looking for a way to force SSL and www. I've been able to force both separately but together I keep running into redirection issues. The following code works when handling a URL in this format: ...
7
votes
2answers
4k views

How to prevent access to website without SSL connection?

I have a website that has an SSL certificate installed, so that if I access the website using https instead of http I will be able to connect using a secure connection. However, I have noticed that I ...
7
votes
2answers
554 views

Using HTTPS on the entire sites 2011 and beyond

I know this has been asked before, but I am curious what all of you guys think, with the advent of programs like firesheep, released only 6 months ago. Is it a good idea to use https on an entire ...
7
votes
5answers
216 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
7
votes
3answers
3k views

Google indexes my site as https as opposed to the correct http

Over the last month, the home page of my website hosted on Media Temple's grid server and has been appearing in google listings as an https website. I have never requested or needed the extra ...
7
votes
2answers
348 views

Looking for SSL certificates (first time)

I need to buy SSL certificates and it is the first time. 1) My option would be the "cheapest ones". What am I going to risk, what kind of service quality I'm going to lose if I buy the cheapest ? Are ...
7
votes
3answers
10k views

Why would you use document.location.protocol instead of plain // prefixed urls?

For instance Google Analytics uses document.location.protocol in the boilerplate for tracking: <script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', ...
7
votes
2answers
670 views

2 SSL certificates?

I just spend ages moving all static content to a cookiless domain to help performance, it seems to work great! It got me thinking though, when I install SSL on my main site, am I also going to have ...
7
votes
2answers
421 views

Using wildcard certificates

Can I buy a wildcard certificate to use the same SSL certificate on multiple domains? For example, www.example.com, www.example.org and www.example.net (on different hosting services)? If I can, Is ...
7
votes
1answer
317 views

Should we get an EV Certificate?

Our regular SSL provider is offering EV certificates for under $US200, and it just so happens that the certificate for our B2B e-commerce site is expiring in a month (which should give us enough time ...
6
votes
3answers
4k views

HTTPS best practices for SEO and usability

Consider a page, http://example.com, which can be viewed both publicly and when a user authenticates. Now suppose you enable HTTPS for every page when a user logs into your website, but only when they ...
6
votes
6answers
5k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
1answer
3k views

How can I set Webmaster Tools to “Fetch as Google Bot” using SSL?

I have page which requires SSL so the page is https://. I want to fetch this page as google bot inside of google webmasters' diagnostic tools however Google, from what I can tell, only allows http ...
6
votes
1answer
98 views

If a website is accessed on HTTPS instead of HTTP, should the URLs on the sitemap be HTTPS or HTTP?

I have changed my website from HTTP to HTTPS. At this moment, I have the next rewrite rule working to redirect calls for HTTP to HTTPS: RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ...
6
votes
2answers
157 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
6
votes
3answers
572 views

When redirecting from http to https in a shop site, which status code should I use?

On a shop website, when "Pay now" is clicked we perform a header redirection to the same URL, just an SSL secured https version. In such a common scenario, should we use a permanent (301), a ...
6
votes
2answers
346 views

SSL Warranty - Meaningless?

Lots of SSL seem to come with a warranty: Extended Validation, Green Address Bar 40-bit minimum to 256-bit encryption USD $100,000 warranty VeriSign Trust™ Seal and services Has anyone in history ...
6
votes
3answers
98 views

Does Googlebot support TLS v1.2? If not, what will my TLS v1.2-only site look like to it?

I currently redirect all non-HTTPS connections to HTTPS, and support TLS v1, TLS v1.1, and TLS v1.2. I reconfigured my testing server to accept only a very limited and secure cipher suite and TLSv1.2 ...
6
votes
2answers
626 views

Ad service that supports ssl (secure publishing)

Is there an add service like adsense that supports SSL ads? I wish to put ads on a secured (https) pages but Google Adsense doesn't support it. I know Adbrite works for text based SSL ads but I ...
6
votes
1answer
78 views

Will Bing bot index pages with invalid SSL certificates?

Bingbot and Yahoo Slurp do not support SNI (Server Name Indication) when using SSL. Ignoring other workarounds (multi domain certificates, non-SSL content etc.). Will Bingbot index pages that have an ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
5
votes
4answers
2k views

“Not Provided” keywords from Google search: If your site uses https, does Google always send the keywords in the referrer?

Over the last two years the number of "keyword not provided" referrals from Google Search has grown to close to 30% for my websites. Google does not send the keyword in the referer URL when the user ...
5
votes
4answers
181 views

New Google SEO benefit with SSL - with only a few sections in SSL, or always on?

Google just announced that SSL will affect site ranking positively: http://googlewebmastercentral.blogspot.se/2014/08/https-as-ranking-signal.html I have an Easter Island tourist agency called Easter ...
5
votes
5answers
8k views

How can I pass referrer header from my https domain to http domains?

My website is 100% https. I have links to other http domains. The referrer header is not set when linking from a https page to a http page. From http://en.wikipedia.org/wiki/HTTP_referrer If a ...
5
votes
3answers
6k views

Google Analytics: How can I track between http:// and https:// profiles for a domain?

I'm trying to set up tracking on a project that I'm working on. The main site is at http://www.example.com/ The order page is at https://www.example.com/index.php Currently they have two ...
5
votes
1answer
268 views

Google Webmaster Tools no longer reports search queries now site has gone full HTTPS

After the recent announcement by Google that was speculated for a while in the SEO community, that sites that load over https (ssl) will be weighted slightly higher in the search algorithms, I quickly ...
5
votes
2answers
421 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have ...
5
votes
3answers
320 views

SSL versus EV SSL

As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...