Four good reasons why your website should have an SSL certificate
Also known as TLS, a certificate or the green padlock, SSL makes websites more secure. But how does it actually work? And what form of SSL is best for your website?
Also known as TLS, a certificate or the green padlock, SSL makes websites more secure. But how does it actually work? And what form of SSL is best for your website?
SSL is the popular name for the TLS protocol, which is used to keep internet traffic secure. In the Netherlands, there are about 3.5 million unique .nl websites. Of those, a little more than half a million (42.8 per cent) have SSL certificates -- although all webshops and business websites should probably be using SSL. In other words, there is plenty of room for improvement. Various types of SSL certificate are available. So which is best for your site?
There are three types of SSL certificate. They differ in terms of data verification, or the validation method used when the certificate is issued. The more thorough the issue validation method, the more information the SSL certificate contains.
SSL is a protocol for data encryption, where a 'certificate' is used to link your organisation's details to the encryption key. That makes it almost impossible for cybercriminals to get hold of your visitors' data. Data security is the overriding reason for using an SSL certificate. It shows that you care about your site's security and your visitors' privacy.
If your website obtains personal data from visitors, the use of SSL may be mandatory for you. Even having something as simple as a form that visitors can use to ask for information counts as obtaining personal data. And it's not the case that operating exclusively in the business-to-business market automatically means you don't handle personal data: a contact person's name is a form of personal data, for example. And, as a website operator, you have a responsibility to secure the transmission of that data. An SSL certificate helps you ensure that visitors have the privacy that the law demands. And it's never been more important to protect your visitors' privacy: under the new the General Data Protection Regulation, you can face a heavy fine if your security isn't up to scratch.
For some years, a (valid) SSL certificate has boosted a site's ranking in Google's search results. Google doesn't take account of the type of SSL certificate. However, to get the ranking boost, SSL needs to be used for the whole website. It's not good enough to secure just your checkout page, for example. Being higher in Google's results will increase traffic to your website and therefore your potential income. Certification is therefore a win-win strategy. What's more, starting in July 2018, Google's Chrome browser will label websites without SSL certificates as 'insecure'. At the moment, Chrome puts an 'i' icon in the address bar when you visit a site without a certificate. From July 2018, that will probably be replaced by the red 'Insecure' warning triangle.
There are three types of SSL certificate. They differ in terms of data verification, or the validation method used when the certificate is issued. The more thorough the issue validation method, the more information the SSL certificate contains.
A domain SSL certificate confirms only the identity of the domain's registrant. The registrant's details are checked against the Whois data recorded for the domain name. Because the identity of the associated company isn't verified, a domain SSL certificate is appropriate mainly where data needs to be sent securely, but the identity of the website is less important.
An organisation SSL certificate confirms both the domain registrant's identity and the identity of the associated company, as verified with the Chamber of Commerce. The certificate enables website visitors to view the relevant details.
An extended validation certificate incorporates full details of the company, as verified by detailed cross-referencing with the Chamber of Commerce. The applicant has to provide full company details and show that they really are acting for the company in question. It's only with an extended validation SSL certificate that both the company name and the green padlock icon appear in a browser's address bar. And it's that combination that inspires real consumer confidence.
Domain validation | Organisation validation | Extended validation | |
---|---|---|---|
Green adress bar | X | X | √ |
Secure connection | √ | √ | √ |
Higher in Google | √ | √ | √ |
Registrant verification | √ | √ | √ |
Organisation details in certificate | X | √ | √ |
Organisation details validated with Chamber of Commerce | X | √ | √ |
Applicant verificatio | X | X | √ |
Extra security mobile support | √ | √ | √ |
Type website | Non-public websites (e.g. intranet sites) | public websites | Webshops, Banks, Commercial websites |
If you're one of the many people who are daunted by the technical ins and outs of SSL, don't worry. Your hosting service provider or registrar will be happy to advise. Please contact your registrar for more information. Want to check whether your site's secure right now? Do the test on internet.nl