Purchasing a Public Certificate

Acquiring and Installing SSL/TLS Certificates

An SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificate is a digital certificate that authenticates a website’s identity and enables an encrypted connection. This ensures that data transmitted between a user’s browser and the web server remains private and secure. Websites secured with SSL/TLS use the HTTPS protocol (Hypertext Transfer Protocol Secure).

Having HTTPS is crucial for modern websites as it builds user trust, protects sensitive information (like login credentials and payment details), and is a positive ranking factor for search engines like Google. Browsers also flag non-HTTPS sites as ‘Not Secure’.

Sources for SSL/TLS Certificates

Free Automated Certificates (Let’s Encrypt)

Let’s Encrypt is a free, automated, and open Certificate Authority (CA) that provides Domain Validated (DV) SSL/TLS certificates. Many web hosting providers offer built-in support for Let’s Encrypt, allowing you to easily install and auto-renew certificates with a few clicks from your control panel. This is the most common and recommended option for most websites.

Services like Cloudflare also offer free SSL certificates as part of their CDN and security services.

Commercial Certificate Authorities (CAs)

While free certificates are suitable for most, commercial CAs offer a wider range of certificate types, including Organization Validated (OV) and Extended Validation (EV) certificates, which involve more rigorous vetting processes. They may also offer additional features like warranties or dedicated support.

Examples of commercial CAs include DigiCert, Sectigo, and GlobalSign. You can compare offers on websites like SSL Shopper (sslshopper.com) or directly from CA websites.

Types of Certificate Validation

• Domain Validation (DV): Verifies that the applicant controls the domain name. This is the quickest and most common type, used by Let’s Encrypt. Validation is usually done via email, DNS record, or HTTP file upload.
• Organization Validation (OV): In addition to domain control, the CA verifies the organization’s identity and legal existence. This provides a higher level of trust and typically displays the organization’s name in the certificate details.
• Extended Validation (EV): Involves the most stringent validation process, verifying domain control, organization identity, legal status, and operational presence. While EV certificates used to trigger a prominent green address bar in browsers, this UI feature has been largely phased out. However, the organization’s verified name is still visible in the certificate details.

General Process for Acquiring and Installing an SSL/TLS Certificate

The exact steps vary depending on your hosting provider and the CA, especially if using automated tools like Let’s Encrypt integration.

1. Choose your Certificate Source: Decide whether to use a free automated certificate (like Let’s Encrypt via your host) or purchase one from a commercial CA.
2. Generate a Certificate Signing Request (CSR): If not automated, you’ll need to generate a CSR on your web server. This request contains information about your domain and organization, along with your public key. Many hosting control panels have tools to generate CSRs.
3. Submit CSR and Complete Validation: Submit the CSR to the CA. You’ll then need to complete the validation process according to the certificate type (DV, OV, or EV). For DV, this is often automated.
4. Receive and Install the Certificate: Once validated, the CA will issue your SSL certificate files (usually a primary certificate, an intermediate certificate, and sometimes a root certificate). You need to install these on your web server. Hosting providers often have interfaces for this, or you might need to configure server files directly (e.g., for Apache or Nginx).
5. Verify Installation: After installation, use an online SSL checker tool (e.g., SSL Labs’ SSL Test) to ensure it’s correctly installed and configured.
6. Configure Your Website for HTTPS: Ensure all website traffic is redirected from HTTP to HTTPS. Update any internal links to use HTTPS. For CMS like WordPress, you might need to update your site URL settings and use a plugin to handle mixed content issues.

Many modern hosting platforms and services like Cloudflare automate much of this process, especially for DV certificates, making SSL/TLS accessible to everyone.

Remember that SSL certificates have an expiration date. Let’s Encrypt certificates are typically valid for 90 days and are designed for automated renewal. Commercial certificates have longer validity periods (e.g., 1 year) and require manual or semi-automated renewal.