20

I have a client that needs SSL to protect online donations, but I have limited experience with how/when to use SSL.

I understand that in purchasing a certificate that I am assigning that certificate to an entire domain (IP address really). Is there a way to isolate the encryption to only a single page of the website, or should I just go ahead and secure the entire site even though only one page needs it?

Unsure of best practice here. Please advise.

Improve this question
4
  • stackoverflow.com/questions/1924119/… Commented Jan 8, 2010 at 2:12
  • 9
    If you don't know how to use SSL and you are protecting money, for gawd's sake find someone that does know how to use it!! Commented Jan 8, 2010 at 2:15
  • 1
    You cannot use a certificate to protect an IP address. certificates are tied to the domain only Commented Jan 8, 2010 at 2:49
  • (!) Please notice that you can get signed SSL Certificates without paying thousands of dollars. letsencrypt.org/ creates free of charge SSL certs which are trusted by all the big browsers. (I'm writing this here as this question has a high search engine rank while still being outdated af) Commented Jun 1, 2018 at 6:46

5 Answers 5

Reset to default
34

SSL incurs quite a bit of extra processing time. For low bandwidth sites, the extra processing required by SSL is not really noticeable. But for sites with heavy traffic like Facebook, Twitter and Flickr, the load caused by SSL is heavy enough that they would have to use dedicated SSL encoding/decoding hardware.

So basically yes, it makes sense to minimize the number of pages using SSL. That is why you often see banking sites only protect the actual account pages via https. The home/landing page is usually plain old http.

On the other hand, unless you really are a site like Twitter or Facebook or Gmail, worrying about this is a bit of a premature optimization. First do it simple if you can. Be aware of this issue and be aware of upgrade strategies when your site finally get heavy traffic.

My boss has a saying:

This is a happy problem to have. First solve the sad problem of not having enough users then you'd be happy to have a problem that requires you to refactor your architecture.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

I feel like this answer no longer hits the current best practices. Encryption overhead of SSL is pretty trivial and todays best practice would be "encrypt as much as you can, including all third party content". The HTTP-web (without "S") is dying and that's a good thing. For example google search started ranking down webpages not offering proper encryption (google webmaster blog)
17

You don't encrypt a website with SSL. you encrypt the connection. Therefore if you have SSL enabled for the webserver simply adding https:// to the url will encrypt the connection and whatever page the url points to will be encrypted while in transit.

so https://www.website.com/index.html is encrypted and http://www.website.com/index.html is NOT encrypted

I prefer for that to never happen so I always put my encrypted pages in a subdomain eg. https://secure.website.com/index.html

SSL comes with a couple of gotcha's

1/ a basic SSL certificate will only be valid for a specific domain name so if the certificate for is www.website.com and someone follows a link for website.com a warning will be displayed. (see note below)

2/ SSL requires a dedicated IP (which you appear to have). that means you may have problems if you are on a shared platform. this is because in HTTP the host or domain name is part of the headers but the headers are encrypted so the server can't know where to route the request to. (see note below)

It sounds like you really need to employ the services of someone familiar with ecommerce and SSL to help you. navigating the minefield with limited knowledge and forum responses is not the safest thing to do. especially if financial transactions are taking place because there are other requirements that must be considered such as the legal requirements in storing and using financial information such as credit card numbers.

DC

Addendum:

For donations consider Paypal. They have a complete donation solution and more people will trust it than a roll your own solution.

EDIT 2016: The world moves on and some of the advice above is not as true as it was when originally answered.

SSL no longer requires a dedicated IP address. SNI (Server name indication) resolves that and is almost universal now (IE8 on winXP does not support it and a few phones).

You will find most certificate vendors now include the main domain name as a SAN (subject alternative name) in a certificate. Which is to say they will provide a certificate for both www.website.moc and website.moc if you get a certificate for www.website.moc. Do not assume this, make sure your certification authority specifies it.

Improve this answer

2 Comments

Caveat: secure.website.com/index.html isn't secure at all according to my browser ;) hahaha had to...
Regarding 2/, there now is the Server Name Indication (SNI) extension to address that problem and it is supported by all major browsers. (I assume Windows XP to be dead now.)
4

also, you mentioned that an SSL certificate protects an IP address. This is incorrect. An SSL certificate corresponds to a domain. Many schemes exist where several domains share a single IP address. If one of these shared domains has an SSL certificate, that certificate is only good for that domain, not the others.

Improve this answer

Comments

1

Cookie security is the main thing that I'd point to for your approach.

A user that logs in on your secure login page gets a cookie for their session, right? That cookie's then being transmitted in plain text for someone watching the wire (Firesheep) to intercept and steal the session.

There is additional overhead in terms of negotiation time and CPU load from SSL, but it's rather minimal. If there's anything sensitive going on on your site, just use SSL everywhere.

Improve this answer

Comments

-1

The other answers are inaccurate in this regard: An SSL certificate binds to BOTH a dedicated IP address that is assigned to a static single domain name, unless you purchase a wild card SSL. Both the domain name and IP must match the certificate.

Improve this answer

1 Comment

The client only verifies that the host name matches the name it requested with an SSL certificate issued for a host name (that is, excluding an explicit IP address in a subject alt name IP entry, which is extremely rare). The DNS resolution to an IP address has nothing to do with it. (This works with dynamic DNS if you change your address regularly, for example.) What's difficult is the other way around: using multiple certs on the same IP address: this is possible with SNI (but not always supported at the moment); you can also use multiple host names with multiple SANs (or wildcard certs).

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.