Do we really need an SSL Certificate?
Discussion
Our web design company are recommending we add an SSL certificate to our company website. (Not sure if posting the URL here would be classed as advertising, but it's in my profile). It's a B2B information site, not a retail/transaction site. We don't offer any kind of sign-up/newsletter, but a prospect could enter their details to be contacted. The closer from the web design company is that "Google is giving preferences to secure sites, regardless of whether you accept payment information" & they are "giving their clients the heads up before Google flags two thirds of the web as "unsafe". Ok so the cost is £200 pa (+vat), so not exactly terrifying, but it's the principle, I think. I'd appreciate anyone's input - this really isn't my field. (mods, please move to computers if that's a better venue for this query, ta). Thanks, N.
Use LetsEncrypt and it costs nothing. https://letsencrypt.org/
Splats said:
Tuna, I've just checked my cPanel and I have a "Let's Encrypt" functionality that allows me to issue a certificate and it will be automatically kept up to date. Is it really that simple to get SSL on my websites? Are there any downsides I've maybe not considered?
Interested to know this also...And to the op; they are right... Google will be seeding secure sites higher - I've heard
All websites should be using HTTP 2.0 now really, and HTTP 2.0 requires SSL. An SSL certificate for these purposes does not cost £200! The expensive certificates come with a 'warranty' meaning that you have an insurance policy against people suffering from fraud while using your website (highly generalised explanation alert!). This is only useful if you're accepting some sort of transaction over your website.
A general purpose SSL certificate costs about £30 per year and will give you no 'warranty' but they will check that your contact details are valid. Let's Encrypt are free and do the same thing as a cheap SSL cert in all intents and purposes, but expire far sooner. These are great to use if you have some form of automation for renewing them. I use a service called Laravel Forge for server provisioning, this automatically updates Let's Encrypt certificates before the expire.
Another alternative is to host your domain's DNS on Cloudflare who will upgrade your connection to SSL and HTTP 2.0 free of charge. You'll be sharing the certificate with a number of other domain names, but no one will really notice or care for a basic business web page. They'll also provide optimisations which will speed up your website's performance earning further Google brownie points.
A general purpose SSL certificate costs about £30 per year and will give you no 'warranty' but they will check that your contact details are valid. Let's Encrypt are free and do the same thing as a cheap SSL cert in all intents and purposes, but expire far sooner. These are great to use if you have some form of automation for renewing them. I use a service called Laravel Forge for server provisioning, this automatically updates Let's Encrypt certificates before the expire.
Another alternative is to host your domain's DNS on Cloudflare who will upgrade your connection to SSL and HTTP 2.0 free of charge. You'll be sharing the certificate with a number of other domain names, but no one will really notice or care for a basic business web page. They'll also provide optimisations which will speed up your website's performance earning further Google brownie points.
Edited by ecs on Wednesday 8th March 09:41
Yup, it really is that simple. LE has plugins for a number of panels that will auto-renew the certificate.
The difference is that the LE certificates don't allow you to do complex subdomain/wildcard stuff, which is not going to matter if you are just hosting a simple site, and the certificates are designed to expire very quickly, after just three months. This quick expiry is designed to stop people from using old certificates for impersonation and is why a plugin is necessary to keep your site security up to date.
In general now, browsers and search sites are moving towards demoting sites that don't have a secure connection. You'll notice that a number of the big sites have recently become https only, and that trend will continue. It's surprising PH hasn't swapped yet.
The difference is that the LE certificates don't allow you to do complex subdomain/wildcard stuff, which is not going to matter if you are just hosting a simple site, and the certificates are designed to expire very quickly, after just three months. This quick expiry is designed to stop people from using old certificates for impersonation and is why a plugin is necessary to keep your site security up to date.
In general now, browsers and search sites are moving towards demoting sites that don't have a secure connection. You'll notice that a number of the big sites have recently become https only, and that trend will continue. It's surprising PH hasn't swapped yet.
I have a couple of Wix websites I built myself, I was contacted by someone (a PHer I think) to tell me my websites were not secure and didn't have the SSL certificate, they offered to secure my site for a sum of money and an annual fee I think.
It took me less than 2 minutes to secure both sites through wix for free, I'm sure this person would have seen they were wix based sites and probably knew i could do it for nothing.
Do you know who your websites are hosted through? it might be a very simple fix you can do yourself.
dmsims, all, I know, I know, you're right. Not my call unfortunately. We're tied in & the site design/support/admin is all farmed out to a mate of the company owner...'Nuff said. Hands tied etc & I was just asked if it was a good idea. Never having looked before I thought I'd come on here & check. Appreciate everyone's input, but I think the answer has to be yes, please give us the opportunity to pay you £200 pa...
And?
Sorry I've no idea what game this is. The website is up & you're showing me a blank screenshot of a login. Of our server. Not hosted, supported or administered by me, or indeed anyone in this postcode. If I knew what your image was supposed to mean & what I was supposed to do about it, I probably wouldn't need to be on here asking whether a site needs SSL.
You might as well have sent my dog a picture of Belgium.
If it's broken, or unsecured, or vulnerable, or corrupted in anyway, then what's the problem & what do I need to ask someone to do about it? Thanks.
Sorry I've no idea what game this is. The website is up & you're showing me a blank screenshot of a login. Of our server. Not hosted, supported or administered by me, or indeed anyone in this postcode. If I knew what your image was supposed to mean & what I was supposed to do about it, I probably wouldn't need to be on here asking whether a site needs SSL.
You might as well have sent my dog a picture of Belgium.
If it's broken, or unsecured, or vulnerable, or corrupted in anyway, then what's the problem & what do I need to ask someone to do about it? Thanks.
Gassing Station | Business | Top of Page | What's New | My Stuff