SSL Certificates

Every website that collects any sort of personal information needs an SSL certificate, and today that means every website. Browsers mark pages served over plain HTTP as “Not secure”, search engines treat HTTPS as a ranking signal, and a visitor who sees a warning on your checkout will simply leave.

What an SSL certificate actually does

An SSL certificate does two separate jobs, and it is worth being clear about which is which.

It encrypts the connection between your visitor’s browser and your server, so that anything typed into a form, including passwords, addresses and card details, cannot be read by anyone sitting between the two. On a shared wifi network that is not a theoretical concern.

It proves the site is yours. The certificate is issued by a certificate authority that has verified, to some level, that whoever requested it controls the domain. That is what stops someone standing up a convincing copy of your shop and having browsers trust it.

“We use an external payment gateway, so we do not need one”

This is the most common misconception we hear, and it is wrong for several reasons.

• Visitor perception. Shoppers look for the padlock, and modern browsers actively warn against its absence. A large percentage of visitors will not enter so much as an email address on a page flagged as insecure.
• Accounts and logins. Any page where a visitor enters or views personal information, a username or a password should be encrypted. That protects your customer’s data and it protects you against the charge that you allowed it to be intercepted.
• Data protection obligations. Under UK GDPR you are required to protect personal data in transit. Sending it in clear text is difficult to defend.
• Mixed content breaks pages. Once part of a site is secure and part is not, browsers block the insecure parts, and stylesheets and scripts stop loading.
• Modern browser features require it. A great deal of current web functionality is only available over HTTPS.

Which type of certificate do you need?

Domain Validated (DV) certificates confirm that you control the domain and are issued within minutes. The encryption is exactly the same as on any other type. For most stores using externally hosted payment pages, and for most brochure sites, this is all that is needed.

Organisation Validated (OV) certificates additionally verify that your business exists and is who it claims to be. The company details are recorded in the certificate for anyone who chooses to inspect it.

Extended Validation (EV) certificates involve the most thorough vetting of the organisation. Browsers no longer give them the prominent green address bar they once did, so the visible benefit is smaller than it used to be, but the verification behind them is real.

Wildcard certificates cover every subdomain of a domain, which is useful if you run several sites or services under one name. Multi-domain certificates cover several different domains in a single certificate.

Free certificates and when to pay

Free DV certificates are issued and renewed automatically on all our hosting plans, and for a great many sites they are genuinely all that is required. We will tell you when that is the case rather than sell you something you do not need.

You should consider a paid certificate when you need organisation validation recorded in the certificate, when you want a warranty from the issuing authority, when a payment provider or a client’s procurement process requires a specific type, or when you need a wildcard or multi-domain certificate.

Installation and support

Whichever route you take, we handle the signing, installation and testing. That includes checking that the full certificate chain is served correctly, which is one of the more common causes of a certificate that works in one browser and fails in another.

If you are unsure which certificate suits your situation, tell us what your site does and how payment is taken, and we will recommend the appropriate one, including when the free option is the right answer.