SSL/TSL

[jos]

Hey guys, been a while.:hi:

I'm really interested in SSL/TSL at the moment. I wanted to buy a book about it, but the shops I've seen don't have anything about it, or just the 'business view' on SSL/TSL, which is useless if I want to get the hang of it.

Basicly I wanna use SSL/TSL to secure my webapplications. Anyone got some ideas?


offtopic: 2 more weeks and I can finally return home, still in prague at the moment. I just had to say that.. :o

[the_pm]

I didn't know you were in the Czech Republic (that is what it's called now, right?). I suppose I could have checked your IP :)

From a user standpoint, SSL isn't anything too difficult. You buy a certificate, you get a special key, you follow a few predetermined steps on your server, and you have a secure area on your site. The big question is this: what are you trying to secure? Is it really important the data be sent in a secure fashion? In my experience, https is always slower, often throws error depending on whether you access it with our without the www (unless you set up a secure subdomain), and of course there are ongoing costs associated with this.

[Christopher Lee]

Two quick things off of the top of my head:

1.) When you buy an SSL, always get the reissue insurance if offered. I was cheap once, and learned my lesson the expensive way.

2.) I know that there is an SSL option that you can buy that allows you to use it across multiple subdomains. But my aging brain can't remember it. And, per usual, it costs more.

3.)SSLs are fairly easy to get, and are fairly cheap (dependent on features). Back when I worked for BigGiantCoCorp, we had to forward on the company's Dun & Bradstreet numbers, and fax a raft full of documents, nowadays you can even become a reseller of SSLs (I think GeoTrust has an affiliate program, but don't quote me on that.)

[Simon]

2.) I know that there is an SSL option that you can buy that allows you to use it across multiple subdomains. But my aging brain can't remember it. And, per usual, it costs more.
You are correct. It is called a "wildcard" certificate. Wildcard certs will usually run you anywhere from $500 to $3000, depending on which company you're dealing with.

Simon

[jos]

I didn't know you were in the Czech Republic (that is what it's called now, right?).

Yep, that's right. I actually found your website while I was here, been here for 3 and a half month now... can't wait to return.

Back ontopic: I'm building a webshop for customers. I want it to be completely automated, once installed (which is no problem) but I also wanted it to be secure when customers start shopping, are paying, are logged in etc.

I didn't know actually that I had to 'buy' it. I thought it was some language I had to learn :). So if I want to secure it like this, and use it for multiple webshops (since i am going to sell the webshop multiple times) I should pick this 'wildcard'?

[jos]

by the way, for some reason i can not enter iwdn.net through firefox. At first I thought the website was offline but through internet explorer it seems to be working fine.

This is the error I get:

Bad Gateway
The following error occurred:

[code=DNS_NO_DATA] The IP address was not found during the DNS lookup. Contact your system administrator.
Please contact the administrator.