Deep Dive into SSL Certificate
What Is an SSL Certificate?
SSL (Secure Sockets Layer) is the common name for TLS (Transport Layer Security), a security protocol that enables encrypted communications between two machines. An SSL certificate is a small data file leveraging this security protocol to serve two functions:
- Authentication – SSL certificates serve as credentials to authenticate the identity of a website. They are issued to a specific domain name and web server after a Certificate Authority, also known as a Certification Authority (CA), performs a strict vetting process on the organization requesting the certificate. Depending on the certificate type, it can provide information about a business or website's identity and authenticate that the website is a legitimate business.
- Secure data communication - When SSL is installed on a web server, it enables the padlock to appear in the web browser. It activates the HTTPS protocol and creates a secure connection between the server and a browser. It enables use of encryption algorithms to scramble the data in transit into an indecipherable format that can only be read with the proper decryption key.
Web browsers only show the secure indicators for SSL signed by a trusted CA, like Sectigo. To become a trusted CA, a company must comply with and perform regular audits for the security and authentication process standards established by the leading browsers and the industry standards body called the CA/Browser Forum. When a trusted CA issues a certificate to an organization, the browser will recognize the certificate as legitimate. The browser lets the user know that the web address is secure, and the user can safely browse the site and enter personal information.
What Is the Difference Between SSL vs TLS?
TLS is an updated version of SSL that provides advanced encryption options, however the two acronyms are often referred to as having the same meaning.
Secure Sockets Layer (SSL) was the name of the first cryptographic protocol established to ensure the identity of a server connected across the open internet. This protocol was created in 1995 to enable e-commerce on the web. SSL 2.0 was the first version of the protocol to be used in production systems, and it was soon superseded by SSL 3.0. After version 3.0, standards bodies superseded SSL with a more advanced protocol called Transport Layer Security (TLS). However, by that point the term SSL was in common parlance, and so it continues to persist as the de facto name for TLS.
Although certificates do not themselves perform encryption, standards-based client and server software require the presence of one for encryption to take place. This requirement is in recognition of the fact that without a reliable identity for the party on the other side of a connection, encryption itself offers no protection. Today’s options for encrypting a TLS session include RSA (Rivest-Shamir-Adleman), ECC (Elliptic Curve Cryptography), and DSA (Digital Signature Algorithm).
Types of Certificates
There are different types of TLS certificates available, including:
- Domain Validation (DV) - easiest and most cost-effective way to receive industry-standard encryption
- Organization Validation (OV) - a step up from DV where an organization must be a legally registered business and prove they own the domain
- Extended Validation (EV) - industry standard for business websites which provide the highest level of trust
Other variations of certificates include Wildcard (for a main domain and its subdomains) and Multi-Domain (used to secure multiple domains).
How SSL Certificates Work
All digital certificates are examples of Public Key Interchange, or PKI. At its most basic, PKI depends on a pair of interdependent keys, a public key and a private key. The public key is used to encrypt information, and the private key is used to decipher it. SSL works by making the public key available through the publicly accessible website. In contrast, the private key remains secured on the web server so that any data submitted from the website where the public key is located can only be deciphered by the site owner, creating a secure 1:1 communication.
When a person visits a site with an SSL certificate, a "handshake" occurs to create a secure channel between the user and the organization and protect any data submitted on the website from being compromised. Here's how the handshake process works in real-time:
- A client system such as a popular web browser connects to a server secured with an SSL/TLS certificate.
- The browser sends a request to the server to identify itself.
- The server sends back a copy of its SSL certificate, including type, validity period, and organizational details.
- The browser checks whether it trusts the certificate and sends an approval back to the server. If the certificate is not installed, not up-to-date with the proper security protocols, or not issued by a CA trusted by the browser, the user will see a warning message in the browser's address bar.
- The server sends back a digitally signed acknowledgment to start an SSL encrypted session.
- Any data shared between the browser and the server is now secure. If a hacker intercepts the communication, it will remain encrypted with a cryptographic code that cannot be decrypted.
Use Cases
Millions of websites use SSL to secure browsing on their websites. Not only does enabling HTTPS on all websites provide consumers trust that the website is legitimate and is safe to browse or transact on, but it has also been mandated by the leading browsers such as Google Chrome. Sites without a certificate will display a ''Not Secure'' warning in the address bar.
The growth of global websites, mobile, and internet-connected devices has also expanded the use well beyond just e-commerce. Anyone who needs to share data between devices over the internet securely requires an SSL certificate. It is most commonly used to secure:
- Online credit card transactions
- Web forms and customer logins
- Email and webmail applications
- Corporate communications through intranets, file sharing, extranets, and internal servers
- Cloud-based platforms and virtualized applications
- File transfers over FTP
- Data transfer to and from mobile devices
If a website URL starts with HTTPS:// and there is a padlock icon in the address bar, then the website is using a secure TLS/SSL connection.
Benefits & How to Implement
The primary importance of installing an SSL certificate is to initiate a secure session between a web server and a browser. Once a secure connection is established, all information passed between the web server and the visitor will be kept private and encrypted
Other SSL advantages:
- Increases customer’s trust. The padlock assures customers that their information will not be compromised. The data will be sent to the intended target servers, and it will not be redirected to unauthorized third parties.
- Protects sensitive information against phishing attacks. Phishing sites are fraudulent copies of famous websites whose purpose is to trick you into submitting valuable information like your credit card or social security numbers. Extended validation certificates protect you against phishing attacks by showing the full business name of the website owner in the address bar. Phishing site operators cannot obtain an EV certificate due to the extensive validation requirements.
- Better search engine rankings. HTTPS is considered as a ranking signal by one of the biggest search engines in the world, Google.
There are 3 simple steps for installing an SSL certificate on a website:
- Purchase a certificate issued by a trusted CA - Trusted certificates can be bought from your web-host or direct from a trusted CA. Certificates from a trusted CA will be recognized by all popular internet browsers used by your visitors (Chrome, Firefox, Internet Explorer, Safari, etc).
- Activate and install the certificate - If you bought your certificate from your web-host then they can do this step for you. If you are managing the site yourself then the two steps you need to complete are to generate a certificate signing request (CSR) and then to install your certificate. We have a range of documents to help complete both tasks on different web server software in our knowledge base.
- Convert your whole site to HTTPS - After installing your certificate on your target pages, modify your site so that all content is served securely.
Learn about the different types of SSL certificates: extended validated (EV), organization validated (OV) & domain validated (DV). See use cases & more.
SSL/TLS certificates are used to authenticate the identity of a website and create a secure connection between the server and a browser. There are many different types of SSL certificate options available, all with their unique use cases and value propositions. The level of authentication assured by the Certificate Authority (CA) is a significant differentiator between the types.
There are three recognized categories of SSL certificate authentication types:
- Extended Validation (EV)
- Organization Validation (OV)
- Domain Validation (DV)
Within these authentication types, there are also unique variations available to customers.
When determining which type of SSL is needed for a website, enterprises and individuals should start by choosing the main authentication type that adheres to their requirements. From there, they can opt for a specific package to meet their unique needs. Certain variations are better suited for businesses with a single domain vs multiple domains vs a single domain with several subdomains. Learn about each type below to find the most appropriate, cost-effective option.
SSL Certificate Authentication Types
What is a Domain Validation SSL Certificate?
Domain Validation (DV) SSL certificates provide the quickest, easiest, and most cost-effective way to receive industry-standard encryption. This validation type requires proof of ownership for the secured domain and is typically issued within minutes. Once installed, DV certificates show trust indicators in browsers like the padlock icon and the string https:// before the website domain. Because the legitimacy of the organization is not vetted, they are not recommended for business websites but are ideal for internal sites, test servers, and test domains.
The value propositions of DV SSL:
- Validates control of a domain
- Enables https and the padlock icon in browsers
- Issues within minutes
Address Bar of a Website With a DV SSL Certificate
What is an Organization Validation SSL Certificate?
Organization Validation (OV) SSL certificates are a step up from DV. To receive one, an organization must prove it owns the domain it wishes to secure and confirm that it is a legally registered business. These can only be issued to a registered organization and not individuals, making them more suitable for public-facing websites.
The value propositions of OV SSL:
- Validates control of the domain
- Enables https and the padlock image
- Authenticates the legitimacy of an organization, adding a level of trust
- Shows organization details in the certificate information
- Issues in 1-3 days
Address Bar of a Website With a OV SSL Certificate
What is an Extended Validation SSL Certificate?
Extended Validation (EV) SSL certificates provide the highest level of trust and are the industry standard for business websites. In addition to the trust indicators provided by the DV and OV types, EV certificates activate the “ green address bar “ in select web browsers by displaying the authenticated company name in green adjacent to the web address.
To receive one, website owners must meet the authentication requirements for an OV SSL but also go through a stricter vetting process performed by a human specialist. Research indicates that consumers who see the green address bar on sites experience greater confidence in the site’s legitimacy and are more likely to engage in online transactions. This type is recommended for all business and enterprise websites, but is especially important for any site that requests personal information from users (eCommerce, financial, legal and otherwise).
The value propositions of EV SSL:
- Validates control of the domain
- Enables https and the padlock image
- Authenticates the legitimacy of an organization, adding an additional level of trust
- Verifies the applicant has the right to request an EV SSL and is in good standing with the organization
- Shows organization details in the certificate information
- Activates the green bar in select web browsers
- Issues in 1-5 days
Address Bar of a Website With a EV SSL Certificate
Variations of Certificates
Today's websites have multiple layers of pages, domains, and subdomains. Beyond single domain SSL certificates, there are additional types designed for today's modern websites that apply the authentication type with feature sets to secure unique web environments.
Multi-Domain (MD) or Subject Alternative Names (SAN) SSL Certificates
Also commonly referred to as SAN certificates, multi-domain SSL allow a single certificate to secure multiple domains, including subdomains of a single main domain name or entirely different domain names. One of these can secure up to 250 unique domains with a single solution. They provide a convenient option for organizations that own a lot of domains and are looking for a simplified way to secure them through a single solution rather than purchasing an individual certificate for each. Multi-domain SSL certificates are available in DV, OV, and EV validation options.
Multi-Domain SSL Certificates Secure Multiple Domains
Wildcard SSL Certificates
The Wildcard option is used to secure the main domain and an unlimited number of subdomains under the main domain. For example, www.yourwebsite.com, login.yourwebsite.com, mail.yourwebsite.com, etc. Wildcard certificates offer full encryption for the subdomains, making them an affordable and effective solution for most websites. They are available in DV and OV validation options.
Wildcard SSL Certificates Secure the Main Domain & Unlimited Sub-Domains
Unified Communications (UCC) SSL Certificates
The Unified Communications type is designed for the Microsoft Exchange and Microsoft Office Communication Server environments. This is a multi-domain option that can secure up to 100 domains.
You might be interested in how to configure the SSL certificate in spring boot.