SSL Explained

SSL Explained

What is SSL?

In the context of websites, Secure Sockets Layer (SSL) certificates are intended to help keep visitors safer. These digital certificates help with an authentication process as well as add encryption to connections.

How SSL Works

SSL is an Internet security protocol that adds security elements to connections made between clients and servers. In order for this to work, the server needs to have a digital certificate – the SSL certificate.

The SSL certificate includes information that identifies the server, as well as keys that are used for data encryption. Once the connection is made, the certificate then passes a public key to the client so that it can take part in the encrypted communication.

Think of the whole process as being similar to meeting a business client. When the client approaches, you both say hi. You then present your credentials (business card) to the client who verifies that they’re meeting the right person. Then, you move the conversion to a private meeting room (encryption).

Why the Need for SSL?

SSL helps visitors identify which sites are safer to use
SSL helps visitors identify which sites are safer to use

The world is becoming increasingly connected thanks to rapid development and spread of technology. Unfortunately, that has brought along with it rising rates of cybercrime. Security breaches alone have gone up by 11% since 2018.

Because of these threats, major corporations like Google have taken the initiative to help try and keep web users safer. One method employed was by encouraging websites to increase security for visitors through the use of SSL certificates.

Many search engines today will mark websites that do not have SSL as ‘unsafe’. Those that do will have visible confirmation displayed to users as a form of reassurance. More importantly, websites with no SSL certificate will have their performance in search rankings affected.

For commercial websites, SSL has become a necessity. Since these often handle sensitive financial data, any websites processing payment information must have SSL in order to satisfy Payments Card Industry (PCI) compliance requirements.

What does a SSL certificate do?

In a nutshell, SSL certificates help secure private information. This may include;

  • An SSL certificate helps secure information such as:
  • Payment information
  • User login data
  • Medical records
  • Personal data such as ID or contact numbers

And more.

Different Types and Validation Levels

There are two areas of note when it comes to differentiating SSL certificates – type and validation level. The type of SSL certificate indicates how many websites it is valid for. The validation level indicates how secure the certificate is.

Types of SSL Certificates

There are three types of SSL certificates:

  1. Single domain certificate,
  2. Wildcard certificate, and
  3. Multi-domain certificate

Single domain certificates, as the name implies, is meant for single domain coverage only. This doesn’t include subdomains that belong to that domain. For that, you’ll need a Wildcard certificate that covers everything under a domain name.

For example, a single domain certificate will cover;

www.example.com

While a Wildcard certificate will cover;

subdomain1.example.com

subdomain2.example.com, and more.

Finally, you have multi-domain certificates which cover as many websites as you want.

Certificate Validation Levels

Validation is the most important element of an SSL certificate. While we all know that SSL certificates indicate a secure website, much as with all security, there are multiple levels. 

Three are three levels in SSL validation:

  1. Domain Validation (DV)
  2. Organization Validation (OV)
  3. Extended Validation (EV)

Domain Validation (DV) – DV certificates mean that the certificate is known to be valid for a specific domain name. These are the cheapest and most basic level of SSL certificates around and in fact, can be free.

Organization Validation (OV) – OV certificates go through additional checks with the SSL issuer. This will include buying having to be contacted personally by the issuer. Because of personal interaction, these have an added element of security.

Extended Validation (EV) – EV certificates are the most secure and require a thorough check of the business that’s behind the purchase of the certificate. It may include validation of documents, contact numbers, and more.

Where to Get SSL Certificates

The majority of simple and non-commercial websites can actually use free SSL certificates. Many web hosts today will offer this feature as part of their web hosting plans. Typically, free SSL certificates are offered in partnership with Let’s Encrypt or AutoSSL.

If you need a better SSL certificate, there are three main categories of providers for these. At the lowest level, you have web hosting providers who may resell for a big brand. Then you have specialist SSL stores that sell a variety of SSL brands. Finally, you can go directly to a major SSL certificate provider.

SSL Certificate Sources

Final Thoughts

Since so many web hosts today offer the use of free SSL certificates, it can be very hard to justify non-compliance with this. Aside from being free, most will also have an easy deployment method to make the process of SSL assignment as painless as possible.

Do be aware that some web hosts who sell SSL certificates try to complicate the process to encourage you to buy commercial SSL certificates from them. Although this is relatively rare, it is something to take note of.

author avatar

Author Profile

Grace Tay is a mathematician turned code diver. Her skills are primarily in Java, Objective-C, and PHP. Today she has turned her focus to web technologies and specializes in WordPress. The transition drives her a little nuts sometimes and she bangs out issues on her drums.