What is an SSL Certificate? What is HTTPS?
What is an SSL Certificate? You see that HTTPS in your URL bar every time you visit our website. That symbol has a meaning. It’s not just some random, on the internet it means something.
A padlock is a symbol that represents that an SSL Certificate has been installed on that particular website. But what does an SSL certificate mean?
HTTPS or SSL Certificate
SSL certificates are small data files that bind an encrypted key to a website’s name and its other details. When SSL is installed on a website’s server, anyone visiting that website will see a padlock icon like the one in the image below. Another noticeable change would be that the HTTP in the URL bar would become HTTPS. This means that the HTTP protocol is now Secure.
Initially, SSL certificates were used only on sites where important details like Credit cards, passwords, and such information were used. But in recent times, it has become an unspoken norm to have an SSL certificate for your site. When you visit a website with SSL, a secure session is created between you and the server.
How does SSL Work?
An SSL certificate works on the principles of public key cryptography. It may sound like it is from another planet but it isn’t. Public key cryptography means that there are 2 keys generated which are mathematically related yet unique. One of them is called public key and the other one is called private key. The public key is used to encrypt and the private key is used to decrypt data.
Very true to their names, the public key is public. So it can publicly available and can be used by the users to encrypt data. The keys are extremely long in length which makes it inconvenient to remember them so they are stored as digital certificates. The private keys are private and hence they have to be stored somewhere in the operating system where it can be safe.
Why do we even need it?
So I have told you that it is secure, but I haven’t told you why and how. Well, let’s say that you sent some encrypted data to the server and if some hacker were to intercept it.
He would surely get the encrypted data, but what is he going to do with it. Since he does not have the private key needed to decrypt that data, it will be absolutely useless to him. So it’s a win for us.
Where do I get an SSL Certificate for my website?
There are many Certificate Authorities that provide SSL certificates at some ‘xyz’ price. There are some organizations that provide SSL certificates for free like letsencrypt and freessl. So now you might be wondering why even pay for it when you could get it for free? Well, there’s a small problem. You should know that people will visit your website using browsers. Now our browsers need to maintain something called a CA root certificate. If this CA root certificate isn’t there in your browser, then an SSL certificate from that CA will not be trusted. And this might lead to some errors like this.
Though the users could still visit your HTTPS website and it will be secure, the browser will still say that it doesn’t trust it since the CA’s root certificate isn’t on its list. I hope you get the whole picture. The free SSL certificate providers do not have their CA certificates in major browsers so websites with their SSL’s often get the error as shown in the image above.
It is hence always suggested that you purchase an SSL certificate from some famous company that has its root certificate in major browsers. Some of these include Comodo, DigiCert, and GlobalSign. I hope you are clear with SSL certificates and their purpose. If you have a doubt just drop a comment and I’ll be there for you.
