Welcome to part 5 of the Web Development Overview series. In this installment, we will cover how to secure data flow between user and servers – SSL Certificate.
In previous parts, we have looked at content, design/UX, and backend (Part 1), building apps from scratch and front-end development (Part 2), testing and hosting (Part 3), performance optimization (Part 4), and website caching (Part5).
SSL Certificate – What’s that?
An SSL Certificate is nothing more than a small file. Its primary purpose is to confirm the server identity and enable the encrypted data exchange between users’ browser and the server.
Here you can see simple checklist about how to set up SSL Certificate on your website:
Why do you need one?
Question everything; it’s a good approach in a world where everyone wants to sell you something. So, why would you want to spend between $10 and $1000 a year? In some cases, like e-commerce (or any other online business-processing financial transactions), you may not have a choice. Simply put, if you want to use services of payment gateways like PayPal, Stripe or others, in most cases you will need to invest in an SSL Certificate.
Another reason is trust. People learned that it’s safer to deal with websites with the ‘green bar’ or padlock:
Finally, Google announced some time ago that using an SSL Certificate is the easiest way to improve SEO (Search Engine Optimization) ranking.
Are all SSL certificates identical?
The short answer is NO. There are vast differences between what you can get from each. Let’s go through some of them:
How many sites you can protect with given certificate
Sometimes it’s a single domain, for example www.nopio.com, but you can also get a ‘wildcard’ SSL certificate that can be used with any number of subdomains, eg. www1.nopio.com, www2.nopio.com, secure.nopio.com etc.
Does it show the ‘green bar’ or just a padlock?
A padlock is an indication that the encrypted connection is working, but the green bar shows that the domain and company went through EV (Extended Verification). This means that the company needed to present registration documents to the certificate issuer. It’s usually better to go for the EV SSL Certificate.
This is the length of the cryptographic key and it varies between 128 and 4096 bits. In general, the more the better, but it’s good practice to go up to 2048 bits. With longer keys, you may see performance degradation from the encrypting process.
This is a monetary amount guaranteed by the issuer which covers any losses that users of the protected site claim due to fraud. Again, it’s better to have higher warranty.
Length of protection
Sometimes it’s better to buy the certificate for longer than 1 year as it results in a significant price cut.
Finally, we would advise not to use cheapest option when deciding on the SSL for online business. It’s better to be represented by a well-known brand that people already trust. Even if not many users actually check the brand, it’s still an advantage.
Is there something we forgot to mention? Let us know by getting in touch here. Leave a comment below or tweet us at @nopio_studio.
If you like this series, see also the next part about code deployment (Part 7).