SSL provides several different forms of security. Each is worth something different to different people.
- Tamper proof
- Business SEO
- HTTPS performance with HTTP/2
Perhaps self-evident but this form of Encryption ensures that only the user and the server can read the data being sent.
If you get an official SSL certificate, it will include the name of the website, who owns it, and perhaps contact details. This can prove that your site is legitimate to a curious individual.
Even a Certificate obtained through a free-service such as LetsEncrypt goes someway as to legitimate a measure of ownership over the site.
This is perhaps the most essential feature for a Quoting service. The data is known to have legitimately originated from that web-site. Otherwise one of two legal situations can arise:
- the business must honour a fraudulent quote,
- or the business must reject an honest quote due to an unreliable source.
Neither scenario spells any good for the business.
SSL certificates improve your rankings in search engines such as Google, if a business does not implement https then they will be negatively penalised in search results.
Pages will load faster in modern browsers. Apparently HTTP/2 is more likely to kick in when you are operating over HTTPS. So much so that Wikipedia suggests that wikipedia states "https is a defecto standard" for HTTP/2.1
You will need to obtain a new SSL certificate periodically as they expire.
Excepting the possibility that your site is very high-volume, the load placed on the site due to encrypting/decrypting is negligible.
SSL certificates will only certify a particular domain, when the domain is changed so must the certificate.
The private key associated with the certificate must be protected, if it is compromised all of the security offered by SSL is undone.
The web server will require additional configuration to setup not only the key/cert, but also the port, domain, service, encryption protocols, etc...
The main risk is the complexity factor involved in site administration. The sysadmins need to know a bit more, and remember to periodically install a new certificate.
There are also things you should do with your application, but those should mostly be done irrespective of whether it's running over TLS or not (things like ensuring only those things that should be public are, masking application server specific cookies, etc. etc.).
As a software developer, I would never, ever touch your site if it use http. If you cannot be bothered to provide the slightest bit of security, I won’t want anything to do with you.
My wife knows nothing about security. However, as the wife of a software developer, she has learned not to touch any http sites (plus a few other things). So that’s two out of two people who will never, ever be customers.
Your customer is completely right here. It would be bad enough not to provide https without being asked.