SSL/TLS
Secure Sockets Layer / Transport Layer Security
Cryptographic protocols that encrypt data transmitted between web browsers and servers, ensuring secure communication indicated by the padlock icon and HTTPS in the browser address bar.
In-Depth Explanation
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols that secure communication between clients (browsers) and servers. TLS is the modern successor to SSL, but "SSL" is still commonly used to refer to both. They enable HTTPS, ensuring data transmitted over the internet is encrypted and authenticated.
How SSL/TLS works:
- Client hello: Browser contacts server and requests a secure connection
- Server hello: Server responds with its SSL certificate and public key
- Certificate verification: Browser verifies the certificate with a trusted authority
- Key exchange: Client and server agree on encryption keys
- Encrypted communication: All subsequent data is encrypted
SSL certificate types:
- Domain Validation (DV): Verifies domain ownership (fastest, cheapest)
- Organisation Validation (OV): Verifies organisation identity
- Extended Validation (EV): Highest verification level (company details in certificate)
- Wildcard: Covers domain and all subdomains (*.example.com)
- Multi-domain (SAN): Covers multiple different domains
SSL certificate providers:
- Let's Encrypt: Free, automated DV certificates
- Cloudflare: Free SSL included with CDN service
- DigiCert: Premium certificates with warranty
- Sectigo (Comodo): Various certificate types
- Cloud providers: AWS Certificate Manager, Azure SSL (free for managed services)
SSL/TLS importance:
- Security: Protects data from interception (passwords, credit cards, personal info)
- SEO: Google uses HTTPS as a ranking signal
- Trust: Padlock icon builds visitor confidence
- Compliance: Required for PCI-DSS (payment processing)
- Browser warnings: Browsers mark HTTP sites as "Not Secure"
- Performance: HTTP/2 requires HTTPS, offering better performance
SSL best practices:
- Use TLS 1.2 or 1.3 (disable older versions)
- Implement HSTS (HTTP Strict Transport Security)
- Use automated renewal (Let's Encrypt, cloud provider)
- Redirect all HTTP traffic to HTTPS
- Enable OCSP stapling for faster certificate validation
Business Context
SSL/TLS is no longer optional -- Google Chrome marks all non-HTTPS sites as "Not Secure", browsers block mixed content, and PCI-DSS requires encryption for any site handling payment data.
How Clever Ops Uses This
Clever Ops configures SSL/TLS for Australian businesses, implementing free certificates through Let's Encrypt or Cloudflare, configuring proper HTTPS redirects, and ensuring TLS settings meet current security standards. We handle certificate management to prevent the business-disrupting errors caused by expired certificates.
Example Use Case
"An Australian business upgrades from HTTP to HTTPS using a free Let's Encrypt certificate, configures automatic renewal, implements HSTS, and sees improved Google rankings and increased visitor trust as the "Not Secure" warning disappears."