I\u2019ve never posted publicly about my (and hence the company\u2019s) position on SSL certificates and why we don\u2019t charge for them. I\u2019m hoping this post can serve as a reference not just for our customers, but for anyone who\u2019s looking to build a website and gets confused over parts of the technology involved. This is not really a post meant to describe the technology of SSL in-depth. I\u00a0focus on some basic how’s and why’s, as well as describe some of the current\u00a0shady industry\u00a0practices, and how things are changing for the better.<\/p>\n
<\/p>\n
The\u00a0motivation to write this post came from a potential client. He expressed confusion over how to handle SSL certificates on his site and whether he should have them. Also, because I\u2019ve been receiving unwanted phone and email harassment from Symantec\u2019s RapidSSL team.<\/p>\n
SSL (more properly called TLS, but we\u2019ll refer to it as SSL as it\u2019s what people know) is a standard that\u2019s used to secure and authenticate the connection between a server (where the website lives) and your computer (where you view the site on a web browser). Broadly, it\u2019s doing three major tasks:<\/p>\n
These protections are all good things, necessary for most ecommerce sites, and beneficial for all sites. There used to be arguments against deploying SSL due to the added complexity as well as concerns over performance. This just isn’t the case anymore. In many cases it actually improves performance.<\/p>\n
If you recall in point 3 above, SSL actually verifies the owner of the website. This is so that, in theory, a server can\u2019t be taken over by a different owner and continue to serve pages without a big warning appearing in your browser. While it is possible to generate and issue your own SSL certificates without a CA, it will throw up similar large untrusted website errors. These errors happen because to cover all three tasks a certificate must be\u00a0\u2018signed\u2019 by a trusted figure, the CA. A self-issued certificate only covers tasks 1 and 2.<\/p>\n
A CA is usually a large \u2018security\u2019 company that is supposed to go through a process of manually verifying the documentation of a company or individual requesting a SSL certificate. Examples of CA\u2019s include Comodo, Symantec, and Verisign. Documentation usually includes simple things like email verification, name, and\/or address. For some of the Extended Validation certificates, more advanced documentation like\u00a0a business registration or drivers license copy is required. These companies all charge varying amounts and will continually try to upsell more expensive certificates. It\u2019s also typical that domain registrars will attempt to resell SSL certificates with domain renewal.<\/p>\n
In my experience, they can also be a pain to deal with and often they take forever to actually issue the certificates. In the case of Symantec StartSSL, I had a client from before I started Uber Motif that bought a certificate from them 5 years ago, shut down that site last year, and let the certificate lapse. StartSSL had been emailing me and calling me nearly daily to renew with them, even after I explained the site was defunct and I did not wish to receive their emails and calls about it. No response from their email teams. Eventually they gave up.<\/p>\n
In short, browsers and operating systems arbitrarily gave it to them. Browsers and operating systems trust the CA signing root and intermediary certificates. Browser developers (Microsoft, Mozilla, Google, Opera, Apple) all agreed to trust a list of CA\u2019s from around the world and they constantly make decisions to add and remove ones from the list. Once a CA is granted this trust unfortunately they can (and do) ignore good security practices and are rarely removed from the lists. Symantec has repeatedly extended the deadline on weakly signed SSL certificates then were given a pass by Mozilla because so many sites use them. Comodo has screwed up so bad in the past that they actually allowed attackers to register fraudulent certificates for Google, Yahoo, and Skype. That’s not even all the major cases I can mention, that would take an entire other post.<\/p>\n
Free CA\u2019s now exist that issue certificates with full security that all major browsers trust. Let\u2019s Encrypt (http:\/\/letsencrypt.org) is what we use to issue our certificates. Let’s Encrypt\u00a0is a nonprofit consortium that worked to solve one of the largest headaches of getting SSL certificates: they automated issuance and renewal. We\u2019re now able to deploy new SSL certificates in a matter of minutes that are just as secure as the costly certificates being sold by Comodo and Symantec. This is allowing us to begin to make SSL a default, not an upsell, as it should be. We encourage people to donate to Let\u2019s Encrypt if they\u2019ve benefited from being able to easily issue certificates. As they are a non-profit organization, this is a tax deductible cause.<\/p>\n
I believe I summarized above why we have never really been interested in funding CA’s… the industry model is dishonest. But that’s not the main reason we never prioritized issuing SSL certificates! The main issue has been the search ranking impact on transitioning a new customer over to SSL. Google claims to provide a search boost for implementing SSL, and they very well might. We have found, however, that\u00a0transitioning<\/em> a site from non-SSL to SSL triggers a full site reindex and there’s about a month of time where organic traffic falls off. This could be disastrous to a blog or ecommerce store that’s monetizing. So for these sites, we typically now suggest they just direct the login and checkout pages to use SSL and leave the rest non-SSL unless they can afford the temporary drop in traffic. New properties we will be going SSL all the way on launch. Our billing pages have been SSL for some time and this site has a certificate issued. I just haven’t had a desire to take the search hit making it default yet.<\/p>\n","protected":false},"excerpt":{"rendered":" I\u2019ve never posted publicly about my (and hence the company\u2019s) position on…<\/p>\n","protected":false},"author":2,"featured_media":7236,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[76,75,74],"jetpack_featured_media_url":"https:\/\/xwaretech.com\/wp-content\/uploads\/2016\/06\/state-of-ssl.jpg","_links":{"self":[{"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/posts\/7227"}],"collection":[{"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/comments?post=7227"}],"version-history":[{"count":0,"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/posts\/7227\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/media\/7236"}],"wp:attachment":[{"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/media?parent=7227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/categories?post=7227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xwaretech.com\/wp-json\/wp\/v2\/tags?post=7227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}