When you develop a website,
there are many things you need to consider. Security is also one of them. With
cyberattacks on websites rising every year, it has become an additional
responsibility of web developers to build a solid foundation for the security
of their websites. SSL is also a part of that foundation. So, if you’re a web
developer, there are certain things you must know about it in order to ensure the
security of your websites. Here we’re going to cover those things for
you, so you can develop websites that are SSL-protected.
SSL and TLS: What’s the difference
First, an important fact:
What we’re talking about is NOT SSL! That’s right – it’s Transfer Layer Security
(TLS) protocol that secures our webpages today. The TLS is a successor to SSL
3.0, and it was adopted way back in 2014 after SSL was found vulnerable to
POODLE attacks. However, SSL continued to be the mainstream term for secure
data transfer protocol of Web, which is why we still talk of SSL instead of
TLS. But as a developer you should keep in mind that although we call it SSL,
we’re referring to TLS.
How SSL works: The TLS Handshake
Now, the next important
thing for a developer to know about SSL is how it works. Basically, it works by
establishing a secure connection known as a “session” between the web browser
of a user (known as “client”) and the host of a website (known as “server”). This
secure connection is established over HTTPS protocol, and here’s how it’s done:
- Client Hello: Whenever a user
fires any HTTPS-based URL from his/her web browser, the browser sends a “hello”
message to the web server hosting that URL. This message also includes crucial
details about the capabilities of browser, like the highest SSL version it
supports (i.e. TLS 1.0, TLS 2.0, TLS 3.0 etc), the cipher suites supported by
it, and a random byte string called client random. - Server Hello: Upon receiving
this message, the server sends its own “hello” message to the client. This
message includes information about the cipher suite chosen by the server from
list provided by the client, a session ID, its SSL certificate, the public key
of certificate, and another random string of bytes called server random. - Authentication: The client then
verifies the SSL certificate sent by the server from its Certificate Authority
(CA) to ensure that the communication is happening with the actual owner of a
domain name. - Sending of Premaster
secret: Upon successful verification of SSL certificate, the client sends
another random string of bytes, called a Premaster secret, to the
server. This premaster secret is encrypted by the public key of SSL certificate
that was sent along with the Server Hello message. - Decryption of Premaster
secret: The server decrypts message received from client with its Private key
and extracts the premaster secret. - Creation of
Session keys: Now the server and client both create session keys from client random,
server random and premaster secret. The computation results in same output (aka
same keys) on both sides. - Client ready: Client sends a
“finished” message to server once session keys have been created. - Server ready: Server sends a
“finished” message to client once session keys are created. - Encryption
achieved: That’s it. Secure connection has been achieved now, and webpages
protected with encryption can be transferred now between both client as well as
server.
So that’s how a TLS
Handshake helps in creation of a secure connection between client and server
over HTTPS protocol. Once this connection has been established, both client as
well as server encrypt every file and webpage before it’s sent by them. The
files and webpages are then decrypted by the receiving party (i.e. server or
client) using the session key.
The right time to install an SSL certificate
It’s also important for
every developer to know the right time of installing an SSL certificate. The
SSL certificate should be installed early in the life of a website, usually
before you start uploading your webpages to the server. There’s a solid reason
behind it. If you upload all your webpages and files to the server but install
the SSL certificate later, some of your files (i.e. images, java scripts etc.)
may load through the unsecure HTTP protocol despite your webpages loading on
HTTPS.
Do you know why?
Because your webpages will
have HTTP links referring to those files. And when webpages are requesting a
file over HTTP, it’ll by default load over HTTP instead of HTTPS. It is called
mixed content error. In such a situation, your website may not show the green
padlock of SSL, because some elements will be loading over unsecured HTTP
protocol. When that happens, the browsers may mark your website as ‘Not secure’
despite your website having SSL certificate installed properly. To fix this
thing you’ll have to do the additional work of changing all HTTP references to HTTPS
references in the code of every single webpage that you developed.
Now, if you want to avoid this
problem, the solution is to install your SSL certificate right in the beginning
of site development. If you install it before uploading all the webpages and files
to the web server, the references to all files in your webpages will have HTTPS
links only, thus eliminating the possibility of ‘no padlock’ from all your
webpages.
How to Force SSL: Creating Redirects
Finally, every web
developer should also know how to force a website to load on HTTPS even if
someone tries to access it through the insecure HTTP protocol. That is achieved
by creating redirects, and you should learn how to create the necessary
redirects in your web server to force the loading of your website on
SSL-protected HTTPS protocol. Generally, the process looks something like this
(for example in cPanel):
- Login to the
cPanel (or any other Control panel, depending on your host) of your website; - Navigate to the Redirects
section either by clicking an icon or searching for it; - Create a
permanent (301) redirect for your HTTP homepage (i.e. http://xyz.com/) to HTTPS
homepage (i.e. https://xyz.com/); - Save the
changes.
That’s it. The process may
vary slightly for different cPanel, but it’s roughly the same. You may have to research
a little more to get guide for cPanel.
The pricing of SSL certificate varies
If you’re going to purchase
the certificate yourself, it’s also crucial to know that the pricing of SSL
certificates varies between CAs and vendors. For example, a RapidSSL Wildcard certificate may
cost more or less than a DigiCert Wildcard SSL certificate. Therefore, you
should also do a comparison of pricing before choosing an SSL certificate for the
site which you’re developing.
Conclusion
So that’s what every web
developer should know about SSL certificates. This information can come handy
when you develop your next site as it can save you from doing any sort of
mistakes while deploying SSL certificate. And when you do less mistakes, you’ll
save both time as well as money. So, keep all these things in the back of your
mind, and keep developing!