What are SSL Certificates?

But here the issue arises; man-in-the-middle attacks. More specifically, eavesdropping. Any information sent over the internet is publicly accessible in the moment. Anything you type, click, or interact with is easily-readable for anyone on the network -- intercepting this information as it flows through -- and this doesn’t exactly require much skill or effort to do.

For the aforementioned websites that require no personal information, this isn’t the end of the world, but, for eCommerce sites, this is a very simple but business-destroying oversight.

So how does HTTPS fix this? Encryption.

HTTPS

HTTPS is Secure Hypertext Transfer Protocol. As the name implies, it ensures any information sent through the internet is safe. Of course, it is still interceptable, that cannot be stopped, but it does make it unreadable for anyone trying to nose their way through user activity on websites where it is used.

It does this through encryption, which essentially means it translates plaintext into ciphertext, using a complex algorithm. When encrypting data, both a public key and a private key is generated.

So how does this work? Let’s imagine you’re trying to access Foregenix.com. First of all, you would type, click or paste Foregenix’s URL into your search bar. By doing this, your web browser (the client -- let’s say Firefox) makes a request to Foregenix.

“Give me www.foregenix.com”

Foregenix’s website (the server) would take this request and then create and forward their public key, which has been signed by their Certificate Authority.

The browser would read this and, given that Foregenix is certified by a trustworthy authority, it would create a new secret key, and send it to Foregenix, encrypted by Foregenix’s public key.

Because anything encrypted with their public key can only be decrypted with their private key, the secret key your browser generates and encrypts via their public key will be secure.

With this established, Foregenix and Firefox would agree,

“We are the only two machines that have access to this secret key. It is now safe to send data to each other, which will be encrypted.”

Of course, as I said before, a hacker could still intercept and read these messages as they are being sent. But because they are sent in ciphertext, all they would see is a jumbled, apparently-random, mess of letters, numbers and symbols. This can be brute-forced, but it would take so much time and resources that the large majority of hackers will tell you secured sites are not worth the trouble.

But do I need one?

It wasn’t too long ago that SSL Certifications were only really expected from eCommerce websites, or anywhere that private information is being exchanged. However, as time goes on, it has now become standard for all sites to be secured. One big reason for this is SEO, with Google preferring secured sites over insecure sites, no matter their purpose. Additional to this, the old advice of “Don’t shop on sites without the little padlock” has slowly become “Don’t go to sites without the little padlock.”

Under most circumstances, the answer to the question is a firm ‘yes’. A trustworthy SSL certificate won’t cost you an arm and a leg, and the confidence it gives potential or returning customers (or users) is worth it considering that secure sites are now an expectation.

Is my website safe simply because I have a SSL Certificate?

Short answer? No. You’re in trouble if that is all you have for your website’s security.

As for the long answer: although SSL certification provides one layer of security, your website is not secure. All SSL certificates really do is allow for data sent between a client and server to be encrypted, which only plays a minor role when considering your website’s security.

As an example, if you are using an eCommerce platform, such as Magento, and do not create a custom admin path for your admin panel, an SSL certificate will do nothing to stop hackers from finding this panel and brute-forcing their way in.

Or, if a hacker manages to load malware onto your site which provides a backdoor for later entry, an SSL certificate will not identify and prevent this. It is not a security measure, in this regard.

We advise our customers to scan their websites to identify external vulnerabilities, have a monitoring and alert software to constantly look for internal and external vulnerabilities and a WAF to block 99.9% of online threats.

Our Webscan Solution checks sites for SSL issues. Make sure to get a free scan, if you’re interested. Want to know more? Get in touch at hello@foregenix.com