How to apply a SSL certificate to your website: get the HTTPS

Security is a critical factor when you are collecting sensitive information such as email and password on your website. Enabling HTTPS is one way of achieving such an objective through the implementation of SSL (Secure Socket Layer). The SSL certificate guarantees the encryption of information going to and from the primary server.

Get Your Dedicated IP Address

SSL certificates will provide you with the best security if your website operates under its dedicated IP address. You should disregard the smaller web hosting plans that promote a platform for shared IP addresses as you do not want other multiple websites to use the same location as yours.

A dedicated IP address will ensure that only your website is benefiting from the web traffic. My recommendation for a reliable and affordable dedicated IP host is StableHost. Their $6/month subscription even goes cheaper when you choose the yearly subscription. Their customer support and service performance are exceptional. Moreover, you could just save yourself the hustle and request your current web host to perform your IP upgrade to a dedicated IP address.

Generate Your CSR

Each of the SSL certificates requires a Certificate Signing Request (CSR). The information under CSR uniquely identifies and protects your website. If you are a customer at ssl.com and using the windows server hosting environment, you can easily generate your CSR through the use of a very handy SSL Manager Tool that is already in place. The mode of generating the CSR differs with the server environment, but it is a pretty much straight forward procedure whose result is often the CSR, downloaded and saved as a text file.

The SSL.com Knowledge Base contains an in-depth walkthrough on how to generate CSR for most web servers.

Buy Your SSL Certificate

The next step involves purchasing an SSL certificate which acts like some sort of ID card so as to prove that your website is indeed your website. The SSL certificate entails a paragraph of letters and numbers only known to your website. It is simply a security check password. If a web user uses HTTPS to visit your site, that password is checked for a match before automatically verifying the identity of your website. Thus the content flowing to and from your site is encrypted.

You can create your ‘self-signed cert’ version, but the Certificates Authorities (CAs) are a popular reference point for most browsers. They never fail to have a copy of that long password and thus will only vouch for you if you purchased your certificate through them.

Where to buy your certificates? Try NameCheap and go for their GeoTrust QuickSSL option. Moreover, you will get a site seal that will securely earn your customers’ trust.

Activate The Certificate

Note that the technicality of this step requires that you check with your web host first to see if they can carry it out for you before proceeding. However, if you are familiar with the technical walkthroughs, then you will need to firstly generate a CSR. The task is easy to achieve if you can access your web hosting control panel like the cPanel or WHM.

Once on the SSL/TLS admin area, use the option “Generate an SSL Certificate and Signing Request” and fill out the fields the screen will display.

Your domain name should be on the “How to make cert for an area”. The contact email field can be blank. What follows next will be a display of text blocks.

The first text block is what you need to copy as it is the ‘CSR’ to issue the SSL cert issuer so as to establish your identity. Login to the site from which you bought your certificate, i.e., NameCheap and activate it. Paste the text block (CRS) you copied together with any other relevant field. Your approver email will also come in handy, and once you follow the remaining steps, you should receive your certificate as a .crt file.

Install The Certificate

With your cert in hand, just paste it on the control panel of your web host. If you are operating under the WHM.CPanel, navigate to the SSL/TLS menu and click on the “install an SSL Certificate” option. Paste it into the first text box and then submit. You are now secure to use HTTPS access to your site.

Check Your HTTPS Website

Try accessing your website through HTTPS, if it loads then you have SSL installed and HTTPS protocol enabled successfully. But you need to be certain that the visitors are accessing the site via HTTPS. However, HTTPS protection should only apply to a few pages where sensitive data is submitted like login or cart checkout, or else it would just be a waste of encryption processing. All you need to do is update the target pages’ links to use HTTPS. You can also use the server-side approach to redirect the users to specific pages. Like in PHP

// Require https

if ($_SERVER[‘HTTPS’] != “on”) {

$url = “https://”. $_SERVER[‘SERVER_NAME’] . $_SERVER[‘REQUEST_URI’];

header(“Location: $url”);

exit

}

Or through the mod-rewrite cheat sheet

About the Author

Leave a Reply