WHAT IS SSL CERTIFICATE?

What is an SSL certificate?

An SSL certificate is a digital certificate that authenticates a website’s identity and enables an encrypted connection. SSL stands for Secure Sockets Layer, a security protocol that creates an encrypted link between a web server and a web browser.

Companies and organizations need to add SSL certificates to their websites to secure online transactions and keep customer information private and secure.

In short: SSL keeps internet connections secure and prevents criminals from reading or modifying information transferred between two systems. When you see a padlock icon next to the URL in the address bar, that means SSL protects the website you are visiting.

Since its inception about 25 years ago, there have been several versions of SSL protocol, all of which at some point ran into security troubles. A revamped and renamed version followed — TLS (Transport Layer Security), which is still in use today. However, the initials SSL stuck, so the new version of the protocol is still usually called by the old name.

Types of SSL certificate

There are different types of SSL certificates with different validation levels. The six main types are:

1. Extended Validation certificates (EV SSL)
2. Organization Validated certificates (OV SSL)
3. Domain Validated certificates (DV SSL)
4. Wildcard SSL certificates
5. Multi-Domain SSL certificates (MDC)
6. Unified Communications Certificates (UCC)

Extended Validation certificates (EV SSL)

This is the highest-ranking and most expensive type of SSL certificate. It tends to be used for high profile websites which collect data and involve online payments. When installed, this SSL certificate displays the padlock, HTTPS, name of the business, and the country on the browser address bar. Displaying the website owner’s information in the address bar helps distinguish the site from malicious sites. To set up an EV SSL certificate, the website owner must go through a standardized identity verification process to confirm they are authorized legally to the exclusive rights to the domain.

Organization Validated certificates (OV SSL)

This version of SSL certificate has a similar assurance similar level to the EV SSL certificate since to obtain one; the website owner needs to complete a substantial validation process. This type of certificate also displays the website owner’s information in the address bar to distinguish from malicious sites. OV SSL certificates tend to be the second most expensive (after EV SSLs), and their primary purpose is to encrypt the user’s sensitive information during transactions. Commercial or public-facing websites must install an OV SSL certificate to ensure that any customer information shared remains confidential.

Domain Validated certificates (DV SSL)

The validation process to obtain this SSL certificate type is minimal, and as a result, Domain Validation SSL certificates provide lower assurance and minimal encryption. They tend to be used for blogs or informational websites – i.e., which do not involve data collection or online payments. This SSL certificate type is one of the least expensive and quickest to obtain. The validation process only requires website owners to prove domain ownership by responding to an email or phone call. The browser address bar only displays HTTPS and a padlock with no business name displayed.

Wildcard SSL certificates

Wildcard SSL certificates allow you to secure a base domain and unlimited sub-domains on a single certificate. If you have multiple sub-domains to secure, then a Wildcard SSL certificate purchase is much less expensive than buying individual SSL certificates for each of them. Wildcard SSL certificates have an asterisk * as part of the common name, where the asterisk represents any valid sub-domains that have the same base domain. For example, a single Wildcard certificate for *website can be used to secure:

• payments.yourdomain.com
• login.yourdomain.com
• mail.yourdomain.com
• download.yourdomain.com
• anything.yourdomain.com

Multi-Domain SSL Certificate (MDC)

A Multi-Domain certificate can be used to secure many domains and/or sub-domain names. This includes the combination of completely unique domains and sub-domains with different TLDs (Top-Level Domains) except for local/internal ones.

For example:

• www.example.com
• example.org
• mail.this-domain.net
• example.anything.com.au
• checkout.example.com
• secure.example.org

Multi-Domain certificates do not support sub-domains by default. If you need to secure both www.example.com and example.com with one Multi-Domain certificate, then both hostnames should be specified when obtaining the certificate.

Unified Communications Certificate (UCC)

Unified Communications Certificates (UCC) are also considered Multi-Domain SSL certificates. UCCs were initially designed to secure Microsoft Exchange and Live Communications servers. Today, any website owner can use these certificates to allow multiple domain names to be secured on a single certificate. UCC Certificates are organizationally validated and display a padlock on a browser. UCCs can be used as EV SSL certificates to give website visitors the highest assurance through the green address bar.

It is essential to be familiar with the different types of SSL certificates to obtain the right type of certificate for your website.

How do SSL certificates work?

SSL works by ensuring that any data transferred between users and websites, or between two systems, remains impossible to read. It uses encryption algorithms to scramble data in transit, which prevents hackers from reading it as it is sent over the connection. This data includes potentially sensitive information such as names, addresses, credit card numbers, or other financial details.

The process works like this:

1. A browser or server attempts to connect to a website (i.e., a web server) secured with SSL.
2. The browser or server requests that the web server identifies itself.
3. The web server sends the browser or server a copy of its SSL certificate in response.
4. The browser or server checks to see whether it trusts the SSL certificate. If it does, it signals this to the webserver.
5. The web server then returns a digitally signed acknowledgment to start an SSL encrypted session.
6. Encrypted data is shared between the browser or server and the webserver.

This process is sometimes referred to as an “SSL handshake.” While it sounds like a lengthy process, it takes place in milliseconds.

When a website is secured by an SSL certificate, the acronym HTTPS (which stands for HyperText Transfer Protocol Secure) appears in the URL. Without an SSL certificate, only the letters HTTP – i.e., without the S for Secure – will appear. A padlock icon will also display in the URL address bar. This signals trust and provides reassurance to those visiting the website.

To view an SSL certificate’s details, you can click on the padlock symbol located within the browser bar. Details typically included within SSL certificates include:

• The domain name that the certificate was issued for
• Which person, organization, or device it was issued to
• Which Certificate Authority issued it
• The Certificate Authority’s digital signature
• Associated subdomains
• Issue date of the certificate
• The expiry date of the certificate
• The public key (the private key is not revealed)

Why you need an SSL certificate

Websites need SSL certificates to keep user data secure, verify ownership of the website, prevent attackers from creating a fake version of the site, and convey trust to users.

If a website is asking users to sign in, enter personal details such as their credit card numbers, or view confidential information such as health benefits or financial information, then it is essential to keep the data confidential. SSL certificates help keep online interactions private and assure users that the website is authentic and safe to share private information with.

More relevant to businesses is the fact that an SSL certificate is required for an HTTPS web address. HTTPS is the secure form of HTTP, which means that HTTPS websites have their traffic encrypted by SSL. Most browsers tag HTTP sites – those without SSL certificates – as “not secure.” This sends a clear signal to users that the site may not be trustworthy – incentivizing businesses who have not done so to migrate to HTTPS.

An SSL certificate helps to secure information such as:

• Login credentials
• Credit card transactions or bank account information
• Personally identifiable information — such as full name, address, date of birth, or telephone number
• Legal documents and contracts
• Medical records
• Proprietary information

How to obtain an SSL certificate

SSL certificates can be obtained directly from a Certificate Authority (CA). Certificate Authorities – sometimes also referred to as Certification Authorities – issue millions of SSL certificates each year. They play a critical role in how the internet operates and how transparent, trusted interactions can occur online.

The cost of an SSL certificate can range from free to hundreds of dollars, depending on the level of security you require. Once you decide on the type of certificate you require, you can then look for Certificate Issuers, which offer SSLs at the level you require.

Obtaining your SSL involves the following steps:

• Prepare by getting your server set up and ensuring your WHOIS record is updated and matches what you are submitting to the Certificate Authority (it needs to show the correct company name and address, etc.)
• Generating a Certificate Signing Request (CSR) on your server. This is an action your hosting company can assist with.
• Submitting this to the Certificate Authority to validate your domain and company details
• Installing the certificate they provide once the process is complete.

Once obtained, you need to configure the certificate on your web host or on your own servers if you host the website yourself.

How quickly you receive your certificate depends on what type of certificate you get and which certificate provider you procure it from. Each level of validation takes a different length of time to complete. A simple Domain Validation SSL certificate can be issued within minutes of being ordered, whereas Extended Validation can take as long as a full week.

Server Name Indication (SNI) allows the server to safely host multiple TLS Certificates for multiple sites, all under a single IP address. It adds the hostname of the server (website) in the TLS handshake as an extension in the CLIENT HELLO message. This way the server knows which website to present when using shared IPs. Typically, companies that use shared IPs under one server are hosting companies and they face the everyday problem: ‘how do I get my server to select and present the correct certificate?’

Here’s a closer look at the problem. On an HTTP site, a server uses HTTP HOST headers to determine which HTTP website it should present. However, when using TLS (the protocol behind HTTPS), the secure session needs to be created before the HTTP session can be established and until then, no host header is available.

So here’s the dilemma: with HTTPS, that TLS handshake in the browser can’t be completed without a TLS Certificate in the first place, but the server doesn’t know which certificate to present, because it can’t access the host header.

What Is SNI and How Does It Work?

Server Name Indication (SNI) is an extension of the TLS protocol. The client specifies which hostname they want to connect to using the SNI extension in the TLS handshake. This allows a server (for example Apache, Nginx, or a load balancer such as HAProxy) to select the corresponding private key and certificate chain that are required to establish the connection from a list or database while hosting all certificates on a single IP address.

When SNI is used, the hostname of the server is included in the TLS handshake, which enables HTTPS websites to have unique TLS Certificates, even if they are on a shared IP address.

You may wonder why this is so important. Why do we need a way to support unique certificates for shared IPs?

How SNI Works

SNI breaks this cycle by allowing you to run multiple encrypted websites on the same server through a single IP address. SNI allows a web browser to send the name of the domain it wants at the beginning of the TLS handshake. This in turn allows the server hosting that site to find and present the correct certificate. And all sites running on that server can share the same IP address and ports. For customers, the experience of encrypting a site gets a whole lot better since there’s no need to justify a new IP address with ARIN. SSL deployments are quick, painless, and much more cost-effective.

SNI SSL vs IP SSL: A Quick Analysis

IP-based SSL certificates use the dedicated public IP address of the server on which the website is hosted to map the certificate to the site. In addition to the problem of only a limited number of IPv4 addresses being available, this approach can be expensive — especially when you have multiple websites. (Since webhosts charge a fee for each dedicated IP address.)

SNI, an extension to the TLS protocol, allows each domain or website hosted on a shared server under a single IP to be mapped to a separate security certificate. During the TLS handshake, the client hello uses the SNI field to specify the hostname to which it is attempting to connect. The server parses this request and sends back the relevant certificate to complete the encrypted connection.

Consider the following example:

Bob wants to host more than one site on a virtual server. So fundamentally, one IP address is shared between multiple websites with different hostnames. Bob understands that the server needs to know which of these sites the client wants to connect to and must be able to send out the corresponding certificate. If the server issues the wrong certificate, the client’s connection will fail to establish. This adversely affects his business when customers can’t connect.

Luckily for Bob, SNI allows clients to communicate with the specified hostname on the shared server. So, what does Bob do? He opts for an SNI SSL solution, where the client can tell the server exactly which certificate it’s requesting by referencing its hostname during the TLS handshake.

In contrast, an IP SSL certificate secures the connection based on a unique IP address.

SNI SSL vs IP SSL: Difference Between the Two

The table below makes a quick comparison between IP SSL vs SNI SSL:

IP SSL Certificates	SNI SSL Certificates
IP SSL certificates are associated with unique IP addresses.	SNI SSL certificates are associated with hostnames.
IP SSL certificates can be used on shared servers only if a dedicated IP address is assigned to the website.	SNI SSL certificates can be used with both dedicated as well as shared servers.
An IP SSL certificate is the traditional method of facilitating an encrypted connection and can be used on older systems that do not support SNI.	SNI may not be compatible with older legacy browsers or systems. Browsers compatible with SNI (earliest version) include:IE 7 +Chrome 5.0.342.1 +Mozilla Firefox 2.0 +Opera 8.0 +Safari 3.0 +

Top Multi-Domain SSL with SNI Support

Features	PositiveSSL Multi-Domain (DV)	Sectigo OV Multi-Domain SSL Certificate	Sectigo Multi-Domain/UCC SSL Certificate
Lowest Price	$25.60/yr	$140.00/yr	$127.20/yr
Domains Secured	Up to 250 Multiple Domains	Up to 250 Multiple Domains	Up to 250 Multiple Domains
Validation Level	Domain Validation	Organization Validation	Domain Validation
SSL Encryption	up to 256-bit	up to 256-bit	up to 256-bit
Key Length	2048 bits	2048 bits	2048 bits
Server License/td>	Unlimited	Unlimited	Unlimited
SSL Site Seal	Included	Included	Included
Reissue Policy	Unlimited	Unlimited	Unlimited
Warranty	$50,000	$1,000,000	$500,000
Refund Policy	30 Days	30 Days	30 Days
SAN / UCC Support	Yes	Yes	Yes
Browser Support	99%	99%	99%
OS Support [Desktop]	Yes	Yes	Yes
OS Support [Mobile]	Yes	Yes	Yes

Drop your comment