What Is An SSL Certificate? Everything A Website Owner Needs To Know: Types, Advantages, Disadvantages, Cost, Resources

The internet was introduced as an open mass communication facilitator and no one thought security could be an issue one day. But it became a popular medium for business transactions and protecting sensitive data transported over the insecure internet became crucial. There are many security products and methods are available in the market for different needs, but one of the most common is a Secure socket layer (SSL) certificate.

An SSL certificate is installed by the website owner to the server where the website is hosted. This provides a few specific security features:

• SSL is the transport protocol that encrypts the data transferred between a browser and the server (or between server and server) so hackers can’t read data like credit card numbers.
• SSL certificates use asymmetric keys or Public Key Infrastructure (PKI) to create a shared key to encrypt data securely.
• An SSL certificate enables HTTPS:// where ‘S’ stands for ‘secure’ and displays a padlock sign in the address bar, before the domain name.  EV SSL also shows the organization's legal registered name in the address bar.

When you click on the padlock sign, and then on ‘certificate,' it shows the details such as the issuer's name, the root certificate authority that issued the certificate, issuance and expiry dates, public keys, and intermediate root certificates.

Which is the right SSL for my business? 

There are three main validation types:

Domain Validated (VD) SSL are popular for personal websites, blogs, and informative websites. It is the cheapest SSL certificate that is easiest to get and can be issued in minutes. The certificate authority just verifies that you own the domain. The CA will send a verification email on your business email address (xyz@yourbusiness.com) or ask you to place some files on a particular location in the server. 

Organization Validated (OV) and Extended Validated (EV) SSL are recommended for medium to large size businesses, websites that deal with any sensitive information such as bank details, credit card numbers, SSN, date of birth, etc. For example, sites with eCommerce facilities, paid subscriptions, donation acceptance, or fund-raising options. If your users need to log in to your website by providing a user id and password, then OV and EV certs are preferable. Here, the CA will verify details such as your business registration details, physical address, your business’s presence on an approved online business directory, phone number, and/or use other methods to verify your business’s identity. It takes 3 to 5 days to complete the verification process. An EV certificate will also display an organization's legal registered name in the address bar.

For example,

What is wildcard SSL and multidomain SSL certificates?

If you have multiple domains or domains with different extensions (mysite.com, mysite2.com, mysite.ca, mysite2.org, etc.) OR subdomains (blog.mysite.com, login.mysite.com, gallery.mysite.com, etc.) you don’t need to buy separate SSL for each of them. Wildcard SSL is for securing multiple subdomains, and multidomain SSL is for securing various domain names under the same SSL certificate. There is another option named ‘Multidomain Wildcard SSL’ if you have both, multiple domains and subdomains. 

All domains and subdomains can be covered under one SSL certificate. So, you don’t have to go through CSR generation, verification, installation, and renewal process separately for each of the domains. Plus, you can save a lot more money with these options.

Disadvantages of not getting an SSL certificate

1. The data transferred between the browser and server is in plain text. If a hacker gets access to it, s/he can easily read it. SSL certificate encrypts the data so that even if a hacker manages to get access to the data, s/he cannot read, interpret and manipulate it. Only the intended receiver can decrypt the data with the unique key. If you don’t have an SSL certificate installed, you are making your website hacker friendly and putting your users' information in jeopardy.

1. Google Chrome shows ‘Not Secure' sign in eye-catching red color in the address bar. Other browsers also show some type of security warning to users on HTTP websites.

1. Building customers’ trust is as essential as Oxygen for any business’s survival-Of course you know that!. When users see such a security warning when they visit a website, they feel suspicious about your website. They feel reluctant to share any sensitive details on your website. The bounce rate also increases, which will ultimately affect your online business and revenue.
2. Since 2014, Google has announced that if all factors are equal, it gives better rank to HTTPS website compared to HTTP. So not installing an SSL will eventually affect your SEO.

Key benefits of an SSL certificate

• Only an SSL certificate can remove those pesky ‘Not Secure’ warnings and display the padlock sign and enable HTTPS in the address bar.

•  An SSL certificate shows that you are sincerely concerned about your clients' data security. Your website visitors will consider your business authentic and can trust your website.
• An SSL certificate will boost your SEO efforts with better search engine rankings.

• All paid SSL certificates come with a warranty. In the case of encryption failure, the CA is responsible for paying the damages (up to the warranty amount) to the hacking victim. Encryption failure is rare but not unheard of. Hackers are continually upgrading themselves and are coming with totally new hacking techniques! Even reputable and well-protected websites are getting hacked.

  When such incidences happen, the lawsuits involve a large amount of damages which can      severely hurt any business's financial health. It would be much more sensible to buy an SSL with a generous warranty. It will work like insurance if something goes wrong in the future.

• You can secure online banking, credit card transactions, system logins, passwords, and any sensitive information exchanged online.

• An SSL can also secure webmail, Outlook Web Access, Exchange, Office Communications Server, workflow and virtualization applications, delivery platforms, cloud-based computing platforms and hosting control panel logins.

How to get an SSL certificate?

After purchasing hosting and domain name, the website owner needs to get an SSL certificate. Some hosting providers provide a free basic SSL. Or you can buy an SSL certificate directly from the certificate authorities. Popular certificate authorities are Sectigo (previously Comodo CA), Symantec, RapidSSL, Digicert, GoDaddy, etc. You can also get the same SSL certificates from authentic vendors such as SectigoStore.com, CheapSSLsecurity, 101domain, TheSSLstore, ssltrust.com.au, etc. Vendors buy certificates in bulk at a discounted price and provide it at much lower rates. So, do your market research before purchasing an SSL certificate. There are some non-profits like Let’s Encrypt that offer free SSL. Of course, these certificates are basic (DV) - for more upgraded SSL (OV and EV) you still need to go for paid SSL. Note that free SSL providers don't provide customer support and warranty too. But if you are good with technology, don't need technical support while CSR generation and installation process and have just an informative website, you can surely go with free SSL.