Thumbnail Guide to SSL and TLS Certifications

SSL Certifications

SSL (and TLS) keep web connections reasonably safe from eavesdropping and in-transit hacking.

WHAT IT IS

SSL (secure socket layer) and TLS (transport layer security) certifications keep web connections reasonably safe with a system of secret handshakes, lock boxes containing keys to other lock boxes and passwords. Think “prohibition era speak easy” and you’ve got a good idea of what’s going on. The certificates are random strings of numbers that cannot, statistically speaking, be hacked. Of course, the Russian mafia has deep pockets.

WHAT IT DOES

The good news is that with an SSL or TLS certificate user data such as credit card numbers are protected during transmission. (TLS is more secure and almost no host supports it at this time. Eventually we will all need to upgrade to TLS.)

The bad news is that once that information goes into your online databases, it is not immune from being hacked. Once someone is inside the speakeasy, they could, theoretically, jump the bar and start swiping bottles. General business liability insurance most likely DOES NOT cover liability that results from either data transmission interception or hacking.

WHICH VENDOR

SSL and TSL are generic security measures. They are an interchangeable commodity. People have their vendor preferences, but the only real difference is price. The mechanics of all SSL and TSL certificates are the same.

Some companies sell their certificates for $2700 + tax + $500 name fee. A knowledgeable webmaster can generate their own, equally secure, certificates in house for free. Some companies offer $250,000 in issuance insurance. This is a red herring. This insurance DOES NOT protect from liability issues resulting from transmission hacking, it only allows us to get back up with the same certificate if a web server blows up or otherwise goes off line.

In the personal opinion of Ofazomi, the vendor choice is irrelevant and I advise going with the free or low cost SSL certificate provided with just about any hosting account. The critical issue here is to have an additional rider drawn up and added to your company business liability insurance policy specifically covering security breaches related to an online store.

NAMES! NAMES! I WANT NAMES!

GeoTrust and VeriSign/Symantec are both well respected SSL Certificate vendors.