Tag Info

Hot answers tagged

22

"My question is, what makes a $10 certificate better than a $100 certificate?" Most of the time the more expensive the certificate, the older the certification company is. Since the list of trusted companies ships with the browser, an advantage of using a more expensive certificate is that it will be trusted by old browsers. For example, maybe a ...


22

The most well-known case study on SSL deployment costs is Gmail's switch over to all-SSL for all requests. Adam Langley, Nagendra Modadugu and Wan-Teh Chang gave a talk on this at Velocity 2010, which Langley later did a write-up on on his blog. According to the people at Google, the argument that SSL deployment has to be very costly for large sites has ...


20

Your proposed solution is the best way forward from an SEO perspective. You avoid duplicate content by using the canonical URL and the 301 redirect will transfer most of your PageRank (a small amount is lost in the redirect). Plus thanks to the strength of Stack Overflow's pages in Google I would be more then stunned if you saw any fluctuations in your ...


17

CloudFront with CNAMEs and HTTPS is not supported, see the first note in the CloudFront CNAME documentation. I don't think any of the low cost CDNs have support for CNAMEs and HTTPS together, to do that they would have to have some way for you to upload your unencrypted certificate to their CDN network.


16

Apart from unserious offerings, you can distinguish between cheaper domain-validated SSL certificates and the more expensive extended-validation SSL certificates (EV). Both certificates are technically the same (the connection is encrypted), but domain-validated certificates are cheaper, because the seller only have to check the domain. The EV-certificates ...


15

A few things. In theory, the better and more expensive SSL providers are supposed to validate who you are in some way and vouch for your identity. This takes time and manual effort and thus costs more. Traditionally manual validation (as used by VeriSign, Thawte, Entrust) has been cumbersome, long winded and expensive for the SSL Provider and therefore ...


14

Google doesnt care, but it may be a waste of your bandwidth. The common approach is to use non ssl on pages where data is not entered into forms or form values are processed and ssl on pages where they are. Google sees an https:// and http:// request as the same. But will see the www.example.com and example.com as two seperate sites. Most sites just use ...


13

Internet Explorer and I think some other browsers will warn a user when the assets for a site using the https protocol are served from http. The first best solution is to allow your static asset server to serve secure content and have your site use a consistent protocol. The second best solution is going to be to create a page on your secure site that is a ...


13

As suggested, I asked the question on ServerFault: http://serverfault.com/questions/161768/restart-webserver-without-entering-a-password But the short answer is: Backup your key: > cp server.key server.key.org Strip out the password: > openssl rsa -in server.key.org -out server.key [enter the passphrase] The newly created server.key file has ...


12

There are a few ways you can do this but if you have the URL Rewrite Module installed, it's fairly easy and a good way to do it. You can paste the below configuration into your site's web.config file. <rewrite> <rules> <rule name="https redirect"> <match url="(.*)" ignoreCase="false" /> ...


11

Certificates are priced and issued depending on your need. Lower end certificates are good for simply providing an encrypted connection for your visitors, useful when you collect personally identifiable information that is not financially related. The verification process to get one of these is usually very simple: The certificate company looks up the ...


11

Unfortunately, the only general solution to this problem is to give your users the https:// only and make sure that they expect to use that only. It is ultimately the responsibility of the user to check that they are using SSL/TLS, as they expect. Other solutions are vulnerable to man-in-the-middle attacks, even if the website only accepts SSL/TLS ...


10

Yes, there's a reason you shouldn't use it for the whole site. Some browsers (depending on brand and version) will not cache content from HTTPS requests to disk, which can seriously slow the browsing experience for users, as static assets will be loaded with every page request (style-sheets, javascript, header images etc). For example, Mozilla states that: ...


10

PLEASE NOTE THE EDITS & UPDATES BELOW As of me writing this (May 23 2012), SSL is supported via the CloudFront distribution URL only. Meaning, you cannot CNAME the SSL URL. Concretely, you can reference an item via SSL as: https://[distribution].cloudfront.net/picture.jpg but not: https://cdn.mydomain.com/picture.jpg where cdn.mydomain.com is a ...


10

Yes, it's normal. ISPs, particularly AOL and mobile providers, can route traffic through different proxies which will change the IP address of a user as they surf the web. Users using a proxy server can also experience this. This is why depending on a static IP address from a user during a session is not recommended for any kind of identification system on a ...


10

A “mixed scripting” vulnerability is caused when a page served over HTTPS loads a script, CSS, or plug-in resource over HTTP. A man-in-the-middle attacker (such as someone on the same wireless network) can typically intercept the HTTP resource load and gain full access to the website loading the resource. It’s often as bad as if the web page hadn’t used ...


10

An SSL certificate does not specify an IP, a protocol or a server. SSL cerificates are, however, tied to a specific (sub)domain. So yes, you can use the same certificate for both, even if you decide to host website and FTP server on two different locations. Some certificates even allow you to change the subdomain (so called wildcard certificates), but ...


8

You need to set up cross-domain tracking in Google Analytics. Follow the linked instructions to do the following: Set up a master profile for your primary domain without filters. Create a profile especially for cross-domain tracking and re-use your tracking code. Modify your cross-domain profile with a filter to show the full domain in your content ...


8

Yes, you need a dedicated IP address for your SSL certificate. The following article explains exactly why: SSL certificates on Sites with Host Headers The key paragraph is: It's a chicken and egg problem: The host name is encrypted in the SSL blob that the client sends. Because the host name is part of the binding IIS needs the host name to ...


8

Comodo have a root certificate whose public key is included in your web browser. The private key that matches the public key is used to sign SSL certificates that Comodo issue, and it can't be faked because no one else has the private key that matches the public key in the web browser.


8

There is no way to do it in robots.txt itself as served over HTTP. You could serve a different robots file entirely for secure HTTPS connections. Here is one of doing so using rewrite rules in your .htaccess file: RewriteEngine On RewriteCond %{HTTPS} =on RewriteRule ^robots.txt$ robots-deny-all.txt [L] Where robots-deny-all.txt has the contents: ...


8

Web browsers do not care about canonical URLs. It is for search engine use only (specifically Google). Additionally, canonical URLs do not affect the loading or rendering of a web page. So no assets will be loaded over HTTP which is what would cause an insecure error message. So, no, they will not display any error message.


7

If you are planning to run full SSL, make sure that any hosted third party services you're using (ad server, analytics, sharing tools, etc) have SSL versions available, or you'll get mixed content warnings on some browsers.


7

In terms of security there isn't any difference. What you really buy is the certification's company verification that persuades your customers you are trustworthy. That is why Verisign sells the same services for x10 the amount of others. Also in higher-priced certificates there is an extra level of verification (where you need to send company verification ...


7

You need to add your domain a second time in the home page with the prefix of https. So your domain will be registered twice, once with http://* and once with https://*. You can then request the page from site with the https prefix. http://www.google.com/support/forum/p/Webmasters/thread?tid=7c6303361bcaeaf7&hl=en


7

You need to drop the 'http:' prefix from all image (and any other) links on your site. When you do so, your browser will default to whatever protocol the page loads with. For example this is best: <a href="//www.example.com/"> And this is not: <a href="http://www.example.com/"> The top example is perfectly valid markup and you will load all ...


6

I usually go with secure.domain.com because it gives me more flexibility as far as administration. For instance, I can put that subdomain on another server, behind some better IDS/IPS gear and possibly attach it to a private network that I don't want the web servers touching. Its a good place to park multi purpose things, such as: ...


6

One word: StartCom http://cert.startcom.org/



Only top voted, non community-wiki answers of a minimum length are eligible