SSL FAQ

TLS (Transport Layer Security) the successor protocol and an improved version of SSL (Secure Sockets Layer). It works similar to SSL using encryption for protecting the transmission of data and information.

Moreover, SSL Certificates are one of the digital certificates which prove that the identity of the websites is authenticated and all the information sent to SSL installed website will stay encrypted with the help of SSL/TLS technology.

Whenever a user visits a secured website, an SSL/TLS Certificate installed on it offers identification information regarding its web server and creates an encrypted connection. Furthermore, all of this process is done within a second.

Let’s see how does an SSL work?

• Web browser or server tries to connect with the server of a website secured with an SSL/TLS Certificate and make a request to a web server for identifying themselves.
• Copy of a web server’s SSL/TLS Certificate is sent to the browser or server.
• Once the browser/server receives it verifies whether to trust the SSL/TLS Certificate and then sends a message to the web server.
• The web server sends back an acknowledgment in a digitally signed format for starting an SSL encrypted session.
• Now, the access is granted to share encrypted data between the web server and the browser/server.

Yes. If you have a website, SSL is needed. Earlier, it was okay to have an SSL only for the website which was collecting information from the user. But after Google’s update regarding SSL, it is needed no matter what type of website you have, whether you collect the information or not. Even a simple blog will also display a “Not Secure” if the SSL is not installed on it.

SSL/TLS Certificate installed on the website means it helps to secure the data transferred between the visitor and a website and vice-versa. Though one thing has to be noted that, it doesn’t mean the information on the server is secured, as once the sensitive data reaches the server it’s up to the admin on how to keep it safe for example, encryption of database.

In other words, HTTPS means HTTP is sent over an SSL encrypted connection which covers GET & POST with other HTTP actions while keeping it safe and unaltered as all the data is passed via an SSL tunnel to the client browser.

The SSL protocol is implemented around the HTTP protocol, whereas in the OSI model, it’s usually implemented in an application layer, but again strictly, it is in the session layer.

While in the OSI model, it’s something like:

• Physical Layer such as Wi-Fi or Network cable
• Data link Layer like Ethernet
• Network Layer like IPV4
• Transport Layer (TCP)
• Session Layer like SSL
• Presentation Layer
• Application Layer like HTTP

Both TLS & SSL are protocols used for sending data over the internet securely. Though there’s a minor difference between them, still TLS and SSL are considered as a different standard. TLS (Transport Layer Security) is an advanced version of SSL (Secure Sockets Layer), which uses stronger encryption algorithms and also has the ability for working on different ports. Furthermore, TLS versions do not work in conjunction with SSL version 3.0.

Put simply, SSL is one of the security protocols used for establishing a secured connection between a web browser and the web server, which ensures users that all the data passed between a web browser and web server remains integral and private.

In other words, SSL certificates are one of the small data files which are digitally bound cryptographic key with an organization’s details. Usually, it is used for securing sensitive transactions over the internet such as transactions made with a credit card or online banking, login credentials and more.

SSL (Secure Sockets Layer) is the security protocol used for establishing a secured connection between web-browser and the webserver. It’s one of the industry security standard protocol, which is used by many websites for securing the online transactions of the clients. On the other hand, HTTPS (Hypertext Transfer Protocol over Secure Socket Layer), works as a sub-layer under the HTTP application layering. Here, HTTPS encrypts the regular HTTP message before sending and decrypts a message during its arrival.

The main reason to use SSL is to encrypt and secure sensitive information sent over the Internet, so only the recipient who is intended can have access to it while making it unreadable to any third-party in-between. As any information sent over internet pass through various computers before reaching its destination server, ultimately making your sent information such as credit card details, login credentials vulnerable to attacks, if it’s not encrypted with an SSL certificate. Additionally, SSL is important because it provides:

• Authentication: Provides surety that the information is sent to the right server and not any fraudster who is trying to steal data.
• Trust: Visual trust indicators such as a green bar or a lock icon are displayed on the popular web browsers like Google Chrome or Mozilla Firefox, letting your website visitors know about your genuineness.
• PCI Compliance: Pass the audits and satisfies the requirement of the Payment Card Industry (PCI) standards, which are needed for any website which accepts credit card details.

SSL/TLS Certificate works on RSA Asymmetric Encryption and Symmetric Encryption. Where Asymmetric Encryption helps to establish a secure client-server session and Symmetric Encryption for exchanging information securely over the already established secured session, also called as “SSL Handshake.”

If you own a website these days, it’s a compulsion that you must have an SSL/TLS certificate installed on it. Now, it’s no more like any luxury, but it’s more a necessity. Additionally, some of the benefits you get by installing an SSL/TLS certificate are like:

• SSL helps in protecting your server-client transactions such as sharing of credit card number while purchasing online by making an encrypted tunnel between the two.
• SSL helps in providing authentication of the website. It helps in identity verification, which is an important aspect regarding web security.
• SSL helps in satisfying the requirements of PCI/DSS as a website needs to be PCI compliant to receive online payments.
• It provides visual trust indicators which help in boosting the trust and confidence of website visitors.
• SSL helps in establishing non-repudiation with the combination of Encryption, Integrity and Authentication. In other words, SSL makes a secured transaction due to which none of the party, i.e., server or client can say that the communication is coming from someone else.
• Removes web-browser security warning message “Not Secure.”

Yes, you can get SSL for free. Some of them who provides are as below:

Let’s Encrypt: A collaborative project of many tech giants offers an SSL/TLS Certificate for free. Additionally, it’s automated, which means there’s no need to create CSR. All these processes happen in the background without giving you any hassle.

Comodo: It’s one of the branded Certificate Authority and yes it offers a free SSL certificate for 90 days period validity. It’s one of the best choices to look around and get familiar with SSL or any short-term project.

Cloud Flare: Cloud Flare one of the popular CDN & Security Company recently announced that they do offer free SSL universally, even for the free plan users.

StartCom: It provides a class 1 Domain Validated (DV) SSL/TLS Certificate for free, which is one of the good choices for a personal blog or website.

WoSign: It’s one of the Certificate Authority, who offers an SSL/TLS Certificate for first two years free. Additionally, SSL Certificate provided by them supports SHA2 algorithm.

SSL For Free: It uses ACME server of Let’s Encrypt and provides DV (Domain Validated) SSL certificate for free which are issued within a few minutes.

Additionally, some other who provides free SSL/TLS Certificate as a trial for the first 30 days are:

• GeoTrust
• Entrust (60 Days free trial)
• Trustico
• Quality SSL

Generally, SSL Certificate Authorities and providers such as Secitgo, DigiCert, Thawte, TheSSLStore, Namecheap, CheapSSLSecurity, RapidSSLOnline, offers three different validation types of SSL/TLS Certificates namely, Domain Validated (DV), Organization Validated (OV) and Extended Validated (EV). Based on your requirement, you can choose any of the ones which suit the best, like:

• Domain Validated SSL certificate is best for personal blogs or websites
• Organization Validated SSL is good for the organization’s website which has to deal with critical data
• Extended Validated SSL certificates are good to go for any shopping portal or any website which does financial transactions online such as Banking website.

Though, from whom you purchase does make a difference. For example, SSL Certificates purchased from Certificate Authority will be a bit high in price whereas their resellers offer the same SSL/TLS Certificate at cheaper rates due to the discount they get from the Certificate Authority for purchasing in bulk.