An SSL certificate is an important addition to your website. We explain why you need one, costs and how to take action to protect your reputation.
“Google says my site is unsafe.”
We have been hearing this from some of our clients for a little while now. There also seems to be a lot of scare-mongering and overblown commentary being bandied around at the moment, some of it being inappropriately linked to GDPR as well. Although the following is a little long it will hopefully bring some perspective to the issue.
Earlier in the year Google started putting a small message into the address bar on its Chrome browser when it came across the password field of a website login form if the site didn’t have an SSL certificate. In the past few weeks, Google has also started to display a similar message for many other types of website forms, again if the site doesn’t have an SSL certificate. They have also indicated that from December, they will mark all websites without an SSL certificate as unsafe. They are promoting this as a drive to enhance website security and, across the whole of the web, they may well have a point.
What Is An SSL Certificate?
SSL certificates are not a new thing, they have been around for years. Essentially, they are the visible ‘padlock’ one sees on an online shopping site. They work by making sure the data sent from your PC to a website server and back again is encrypted and if that data contains your credit card number or online banking login then this is obviously a good thing. In general, they won’t provide a massive security boost for many websites as the type of data theft they are designed to protect against isn’t in practice very easy to achieve and to be worth the risk for the criminal, needs to have a valuable target.
The commonest attack that an SSL certificate will protect against is when an attacker sets up a fake wifi hotspot in a hotel lobby, airport lounge or similar public space which is designed to appear as the official hotspot. People sign up to the wrong one and the attacker can then intercept their traffic as it passes through the spoof hotspot. In this situation the attacker is looking for credit card, banking and other high value data and an SSL certificate helps to protect data as it is encrypted when it passes through the spoof hotspot and is thus difficult to read.
Do I Need An SSL Certificate?
For most website owners, the main reason to add an SSL certificate to their site will be to protect against a threat to the site's reputation rather than adding a significant boost to the site's security. At present only Google is taking this next step to mark all sites without SSL as unsafe but it is very likely that the other browsers will follow suit at some point. It is also worth noting that Google is indicating that the lack of an SSL certificate will impact on search rankings and for some owners this will also be a significant driver.
How Do I Get An SSL Certificate?
SSL certificates come in a number of ‘types’ and with a range of costs. In general, the cost is driven by the reputation of the organisation issuing the certificate, called the signing authority. A simple SSL certificate from a reputable source should be in the region of £50 - £75 and could need an hour or two of someone’s time to set up and install. The certificate is tied to the site's domain name and if your site has multiple domain names or uses subdomains then the SSL certificate could be more expensive.
Some site hosting setups provide free or very cheap SSL certificates. However, you should be careful that they are not simply ‘self-signed’ by someone who is not on the main browsers' trusted lists. In these situations, the data may well be encrypted but the reputational loss will continue as browsers will continue to label the website as unsafe. Earlier this year, Google removed some quite well-known names from its trusted certificate authorities list including Thawte, Verisign, Equifax and others because it had lost faith in the trustworthiness of their reputation.
Conclusion
In conclusion, the time is almost certainly right for most, if not all, website owners to move to having an SSL Certificate for their websites. Those who have a specific security need will almost certainly already have a certificate. For those now contemplating it, the main reason will be to mitigate the reputational risk of having their site labelled as unsafe, initially by the Chrome browser but in time by all browsers. Your IT team, web development company or hosting provider will be the people to approach.
If you would like to talk to the 101 team about the security of your website, please call us on 01603 858250.
