SSL - Any advice?

[kermey]

I need a security certificate to secure my shopping cart. I don’t want to pay too much but I do want the certificate to work (any advice on how the system works would be welcome – what to look for, how do I know its secure etc etc)

Any advice and recommendations would be really welcome

[swhiting]

you've got two options:

shared ssl - this is the cheapest route - you effectively share a certificate for a host (https://vault.host.com/yourdirectory) and are given FTP access to the subdirectory and put all your secure files there and link to it.

dedicated SSL - you have your own SSL certificate issued for your server (usually quite expensive - but they do vary in price) and your host setup your own SSL site (this will probably be quite expensive also). Major companies such as Thawte (http://www.thawte.com/) and Verisign can issue certificates.

you don't need to have the whole site SSL secure, just the ordering pages where you enter sensitive details. Payments for Worldpay etc are taken over secure SSL server so take the security hassle away from the website owner.

[kermey]

My host does provide the shared cert, is that as secure? What are the benefits of getting your own?

[openmind]

The biggest benefit is really the appearance. If you are on a shared cert the url for the secure pages will lok something like https://yourname.yourhost.com or whatever.

If you had the cert it would be https://secure.yourdomain.com

As the whole point of secure shopping is to make sure the customer is confident, your own cert is best. It isn't as expensive as you think. InstantSSL, http://www.instantssl.com/ssl-certif...dom&country=GB will be able to supply a cert from just £33 per year. From £46 per year they throw in a secure logo to display on your site which visitors can then click on to verify your identity.

All these things will help your customers confidence enormously...

[bone]

try http://www.redstation.com/hosting_secure.asp

redstation do a cheap ssl hosting package

[kermey]

Will this protect my databases too?

[swhiting]

no, SSL will not protect your databases. you will still need to take the measures that I outlined a post the other day for the SSL site.

[openmind]

Really your databases need to be in a folder that cannot be accessed through the web. You need to check with your web host which folder you need to sotre your DB in.

The cert is really there to provide a secure method for the input of sensitive information.

[Mo.]

Hi,

I found the following site to be very helpful when I was in a similar situation: http://www.sslreview.com/

Regards,
Mo.