0

Guys whats the best and the fastest way to get an ssl cert onto your site? I have looked at self certs, are they any good?

I currently trying to get my first website complete [ tobots.co.uk ] and it uses paypal for secure payments which is fine for the supply export site to the UK. Next i working on a full E-commerce shop, i will be using the woocommerce in wordpress.

My server is ubuntu 12.04 without lamp stack, i installed apache2 php DB etc I think i have apache set up for vertual hosts so therefore instead of using one installation of wordpress for lots of sites, i will use other installs to keep the sites more secure and away from each other, or do you think i being paranoid? Any answers on e-commerce guys much appreciated

1

I have not implemented an e-commerce system, but here are my thoughts.

Though it would be hard to say for sure what's best without more details of exactly what you're setting up and what the risks are, generally speaking using separate Wordpress installations for separate sites makes sense, provided that you make sure things are configured properly so that:

  • If one is penetrated or crashes, the others are unaffected and not vulnerable as a result.
  • All of them are maintained (e.g., get security updates in a timely manner).

As for self-signed certificates, if the general public is accessing your e-commerce site and supplying sensitive information like credit card numbers (which I am assuming must be the case, based on your description), you should have a certificate signed by a certificate authority, not a self-signed cert.

The reason for this is that someone else could just make their own self-signed certificate that says they are you.

The signature will not be the same, but there is no way for anybody to know which one is the real you.

Self-signed certificates are mainly good for:

  • Testing.
  • Situations where there is a secure back-channel between you and anyone who needs to trust the connection. (For this, self-signed certificates are sometimes actually preferred, because even less trust is placed in the hands of third parties.)
  • Situations where information about your certificate will be widely published (web of trust). Typically this still only appropriate for websites if your certificate will only be used for SSL connections established for moderately sensitive purposes (not e-commerce).
  • Situations where it is impossible or useless for anybody to sign your certificate because no pertinent certificate authority exists, but your certificate will be extremely widely distributed, verified through other means, and probably even hard-coded into software or distributed under other secure means. I'm really just talking about certificate authorities' own certificates, here.
  • Sites that cannot afford to pay fees to a certificate authority, and don't really need SSL, but provide it with the hope that it will be of some benefit. (If you're doing e-commerce, you need SSL.)

A bit of information on self-signed certificates can be found here (though I guess you may already have read that).

  • Thanks for you input, yea i got lots of work to do over the western holiday xmas.. I have my first supply export website near complete for the UK, next i want to start working on my e-commerce shop for the uk. I got lots of reading to do. really what i need is a business partner. lol – jamjam Aug 21 '13 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.