I was hired to program a basic, plain text site for a local business that amongst other things, provides basic pricing quotes through a Javascript Applet. For obvious reasons, it seemed unnecessary to me to in anyway encrypt the traffic to and from the site. However, the person who hired me strongly requested that I set up HTTPS on the site "for security reasons". Assuming I provide minimal upkeep, is there any further risk associated with setting up the SSL certification?
3
-
3There is a risk in lost profit by not providing an SSL certificate—ssl certificates are an important factor improve your search ranking.– JayCommented Jan 3, 2019 at 3:46
-
This question belongs on security.SE.– l0b0Commented Jan 3, 2019 at 8:17
-
Note that many browsers will display pages without HTTPS as insecure, especially if they contain any input fields. That's a bad look for customer facing pages. Since Domain Validation certificates (e.g. via Let's Encrypt, Cloudflare, or some hosting providers) are free and can be renewed automatically, there is no good reason to avoid them. They do not carry substantial risk (manual renewal would have the risk that your site is unreachable if you had let the cert expire). However, initial setup may take a bit of effort.– amonCommented Jan 3, 2019 at 9:57
Add a comment
|
3 Answers
Security
SSL provides several different forms of security. Each is worth something different to different people.
- Privacy
- Authentication
- Tamper proof
- Business SEO
- HTTPS performance with HTTP/2
Privacy
Perhaps self-evident but this form of Encryption ensures that only the user and the server can read the data being sent.
Authentication
If you get an official SSL certificate, it will include the name of the website, who owns it, and perhaps contact details. This can prove that your site is legitimate to a curious individual.
Even a Certificate obtained through a free-service such as LetsEncrypt goes someway as to legitimate a measure of ownership over the site.
Tamper Proof
This is perhaps the most essential feature for a Quoting service. The data is known to have legitimately originated from that web-site. Otherwise one of two legal situations can arise:
- the business must honour a fraudulent quote,
- or the business must reject an honest quote due to an unreliable source.
Neither scenario spells any good for the business.
Business SEO
SSL certificates improve your rankings in search engines such as Google, if a business does not implement https then they will be negatively penalised in search results.
HTTPS performance
Pages will load faster in modern browsers. Apparently HTTP/2 is more likely to kick in when you are operating over HTTPS. So much so that Wikipedia suggests that wikipedia states "https is a defecto standard" for HTTP/2.1
Downsides
You will need to obtain a new SSL certificate periodically as they expire.
Excepting the possibility that your site is very high-volume, the load placed on the site due to encrypting/decrypting is negligible.
SSL certificates will only certify a particular domain, when the domain is changed so must the certificate.
The private key associated with the certificate must be protected, if it is compromised all of the security offered by SSL is undone.
The web server will require additional configuration to setup not only the key/cert, but also the port, domain, service, encryption protocols, etc...
-
Thank you for the thorough answer, it was extremely helpful. Just to note, the quote applet is entirely non-binding, it is a tool to predict the price, not a commitment. 2 quick follow-up questions though: can SSL be implemented purely in Javascript? And can I dual sign an SSL certificate to 2 private keys? Commented Jan 3, 2019 at 5:11
-
@ShmuelNewmark Unfortunately no, One key per certificate. As for SSL, it should be transparent to the webpage itself. It is negotiated between the Browser and the WebServer. If you are using something like NodeJS for the WebServer you have a choice: handle the encryption in NodeJS (use a framework), or reverseProxy the connection through nginx, apache, IIS, or any other reverse proxy terminating the ssl portion at the reverseProxy and forwarding a raw http connection to NodeJS.– Kain0_0Commented Jan 3, 2019 at 5:39
-
1You can obtain and renew certificates automatically and for free using Let's Encrypt.– l0b0Commented Jan 3, 2019 at 8:15
-
2TLS certificates can certify any number of domains, including wildcards.– l0b0Commented Jan 3, 2019 at 8:15
-
2@l0b0: everyone still calls it SSL and will likely continue to call it SSL until we're all dead and buried. Commented Jan 3, 2019 at 19:01
The main risk is the complexity factor involved in site administration. The sysadmins need to know a bit more, and remember to periodically install a new certificate.
There are also things you should do with your application, but those should mostly be done irrespective of whether it's running over TLS or not (things like ensuring only those things that should be public are, masking application server specific cookies, etc. etc.).
As a software developer, I would never, ever touch your site if it use http. If you cannot be bothered to provide the slightest bit of security, I won’t want anything to do with you.
My wife knows nothing about security. However, as the wife of a software developer, she has learned not to touch any http sites (plus a few other things). So that’s two out of two people who will never, ever be customers.
Your customer is completely right here. It would be bad enough not to provide https without being asked.
answered Jan 3, 2019 at 17:49
