Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [https]

HTTPS is the secure version of the hypertext transfer protocol (HTTP). It usually uses port 443 and is powered by the TLS (formerly SSL) cryptographic protocol.

3
votes
2answers
2k views

SSL certificate - which one to buy? [duplicate]

Possible Duplicate: SSL certificate provider Hello, I'm trying to set up Https for my e-commerce site on webfaction hosting. Was trying to buy SSL certificate from godaddy.com which has my new ...
4
votes
2answers
842 views

Impact of migrating home page from HTTP to HTTPS on search results

I've had to change one of my site's home page to HTTPS from HTTP. I had plenty of links coming into the HTTP page and was performing well in Google against many of my targeted search phrases. I did a ...
5
votes
3answers
2k views

EV SSL Certificates - does anyone care? [closed]

Is any one aware of any data or studies from an impartial source that show the impact of EV SSL certificates on customer behavior? I've been unable to find any such studies. If an EV SSL certificate ...
0
votes
4answers
3k views

Best way to have both HTTP and HTTPS communication in a web application?

I am considering using both HTTP and HTTPS in a web application and I am looking for tips to accomplish this best. The application will run under Tomcat. I have also seen the following about HTTPS ...
3
votes
1answer
269 views

Should every page on every site be behind SSL?

This question stemmed from a discussion here: Ad networks that will serve via HTTPS? My question to the OP was "is it necessary to have every page behind SSL?" Admittedly at the time of posting this ...
6
votes
2answers
1k views

Ad networks that will serve via HTTPS?

I've built a website with 160K page views per month that serves every page over HTTPS. The recent FireSheep news will probably increase the adoption of "HTTPS everywhere" but it's been very hard to ...
2
votes
2answers
389 views

Security - DiscoverCard.com

I have a security, SSL question about http://discovercard.com/ When you first go to Discover Card's Home Page you are able to type in your user name and password without the website being protected ...
1
vote
1answer
468 views

YouTube Embed SSL Errors

Anyone else have problem using a YouTube Embed Code on a https site? The security warning pops up in Internet Explorer telling your users they are loading unsecured data on a secure site. YouTube ...
1
vote
1answer
195 views

Do you want to include your registrant information in third party Bulk Whois requests?

I'm buying a SSL certificate online for the first time. I have this option... Include your registrant information in third party Bulk Whois requests? What does it exactly mean ? What's Buil Whois ...
6
votes
1answer
4k views

Can I expect browsers to cache static content served over SSL encryption?

With all the talk about FireSheep I am thinking of switching my web applications to use full https accross the entire site. However, I am concerned about caching. I use a lot of JavaScript, CSS files, ...
2
votes
1answer
2k views

How to set the Bit Length when generating SSL Certificat with Java keytool?

I'm going to create a SSL Certificate so I can use https on my web site. I have to generate a Certificate Signing Request (CSR) and I did generate such a file with the Java keytool following the guide ...
11
votes
3answers
14k views

Google indexes my site as https as opposed to the correct http

Over the last month, the home page of my website hosted on Media Temple's grid server and has been appearing in google listings as an https website. I have never requested or needed the extra ...
28
votes
4answers
4k views

Is using only HTTPS bad in a SEO perspective?

I would like to set up a new business site. I plan to direct www.example.com to example.com and only use that domain. My plan is also to only use HTTPS and not HTTP. Does this affect the SEO for the ...
4
votes
4answers
2k views

SSL and green address bar

I am new to SSL so can someone explain why my address bar turns green when I'm on certain sites beginning with https:// and sometimes it doesn't even though I know the site has SSL? Maybe these two ...
29
votes
4answers
7k views

What are the benefits of a more expensive SSL certificate?

I've been comparing prices of different SSL certificates and found a massive difference in prices between different providers. If we take http://www.namecheap.com/learn/other-services/ssl-...
1
vote
1answer
227 views

High traffic by “doin' nothing”

We have set up on a VPS a WordPress blog. But, after we work a while, if we leave the tabs open in our browsers, there is upload traffic, in small chunks but quite often. We thought that it might be ...
5
votes
3answers
116 views

What is SSL Hosting and what are the requirements for making secure transaction

I am here in order to collect the information for making secure online transaction. My client has got a online shopping site. We are now having cart in our own site and transfering the cart detail to ...
11
votes
4answers
1k views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
8
votes
3answers
5k views

HTTPS best practices for SEO and usability

Consider a page, http://example.com, which can be viewed both publicly and when a user authenticates. Now suppose you enable HTTPS for every page when a user logs into your website, but only when they ...
6
votes
2answers
508 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have https://...
5
votes
3answers
389 views

SSL versus EV SSL

As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
11
votes
4answers
709 views

Are free SSL certificates secure?

How is it that some SSL certificates are free? What does that mean? Are they secure or not?
7
votes
3answers
569 views

Using wildcard certificates

Can I buy a wildcard certificate to use the same SSL certificate on multiple domains? For example, www.example.com, www.example.org and www.example.net (on different hosting services)? If I can, Is ...
7
votes
2answers
388 views

Looking for SSL certificates (first time)

I need to buy SSL certificates and it is the first time. 1) My option would be the "cheapest ones". What am I going to risk, what kind of service quality I'm going to lose if I buy the cheapest ? Are ...
9
votes
1answer
1k views

Should we get an EV Certificate?

Our regular SSL provider is offering EV certificates for under $US200, and it just so happens that the certificate for our B2B e-commerce site is expiring in a month (which should give us enough time ...
6
votes
6answers
6k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
3
votes
2answers
357 views

CA For A Large Intranet

I'm managing what has become a very large intranet (over 100 different hosts / services) and will be stepping down from my role in the near future. I want to make things easy for the next victim ...
11
votes
5answers
17k views

Why would you use document.location.protocol instead of plain // prefixed urls?

For instance Google Analytics uses document.location.protocol in the boilerplate for tracking: <script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-XXXXX-X']...
10
votes
6answers
2k views

HTTPS for entire site

I'm working on a fairly standard web site with public content plus personal/customized content for registered users. I know I need to use HTTPS when users are logging in or sending credit card ...
3
votes
5answers
2k views

What is the best kind of checkout system for a website?

I have worked with quite a few checkout systems and eCommerce platforms. Are there certain kinds of interfaces that convert sales better than others? For me there are really only two questions: SSL ...
11
votes
6answers
849 views

SSL certificate provider

I need a SSL certificate for a new site I'm building and I have to choose a SSL provider. What to look for when choosing and what's your experience dealing with them? Thanks!
11
votes
2answers
212 views

Choosing which domain to secure

We've got a website that is served on both www.example.com and just example.com - we've never done any sort of forcing users from one domain to the other, so if they land on example.com then that's ...
3
votes
4answers
935 views

is RapidSSL wildcard cert supported by major browsers?

I'm thinking of buying a wildcard SSL cert from clickSSL : http://www.clickssl.com/rapidssl/rapidsslwildcard.aspx That would be a rapidssl certificate, and I was looking into my firefox options to ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
16
votes
2answers
15k views

Is there a way of using HTTPS with Amazon's CloudFront CDN and CNAMEs?

We use Amazon's CloudFront CDN with custom CNAMEs hanging under the main domain (static1.example.com). Although we can break this uniform appearance and use the original whatever123wigglyw00....
8
votes
2answers
5k views

How to serve static content without https in a secure site?

I want to serve static content from my site but my site is https-only. My static http server only serve http content (non https) but many IE users are complaining about being unable to log into. What ...
28
votes
2answers
85k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
5
votes
3answers
4k views

Is it possible to share SSL certificates across servers?

We have a web application we will be launching soonish and for right now we just have one SSL/HTTPS certificate. We have this one certificate shared across 3 servers(in a cluster for load balancing) ...
11
votes
2answers
2k views

Using wildcard certificates for multi-server deployment

Currently we are deploying a beta API for our services and we want that all request/responses from the API works over https. I'm confused about using wildcard certificates for both api and www urls. ...
39
votes
6answers
3k views

Are the different types of SSL certificates a bit of a scam?

I'm looking into getting a few SSL certificates for domains to cover the following: autodiscover.example.com remote.example.com www.example.com Wildcard certificates are too expensive, so I'm going ...
8
votes
5answers
231 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
16
votes
2answers
591 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?