Knowledgebase

But common errors with use of SSL has to do with the installation. Proper installation is crucial and very important to enjoy full SSL functionality. Installing an SSL certificate to your website is a difficult process that requires extra care as slipping off at any point can cause serious security related issues. Some mistakes stem from a lack of understanding about the basic fundamentals of SSL. Other, less obvious mistakes are often overlooked simply because the developer made reasonable, yet inaccurate assumptions. Starting with the most basic mistakes, we’ll go through some of the most common SSL installation problems, explain why they happen and how to avoid them.

Further reading:

Self-Signed certificate:
A self-signed certificate is an identity certificate that is signed by the same entity whose identity it certifies. At first step, you think this to be a good idea and you want this. It is not an issue when your site does not have to build a sound reputation. In most cases, these are sites of commercial use. However, we do not recommend self signed certificates in cases of the sites which are meant for business deals. Therefore, we recommend trusted certificates. Using a valid certificate helps build a sound trust reputation and enables visitors to trust your website even more.

Be clear about the difference between HTTP and HTTPS:
When people are first starting out with SSL they often don’t have any understanding of the basics of how it works, but some abstract notion of the page being protected by encryption throughout its entire lifespan: being created, transmitted to a browser, used by a user and, in the case of something like a form, transmitting sensitive data back to the server. They make the assumption that everything is safe because the page has been encrypted, but it actually isn’t. The classic mistake people make when they try to secure things like login forms is to serve the login form page from a secured https address, then have the actual login data posted back to the server over a standard http address.. Using SSL in this way doesn’t provide encryption protection over its entire lifespan. The page and any other data such as the contents of a form are only protected while being transmitted in either direction between the browser and the server. Once a page has finished downloading, it’s no longer protected by SSL. In this situation, the login data which should be protected is transmitted unencrypted, and the form which doesn’t need any protection is downloaded over a securely encrypted connection. Developers new to SSL and the users of their forms are lured into a false sense of security because they see that the address of the page containing the form begins with https.

Further reading:

Choose trusted certificate provider:
This is a step which you should take care of ,not only for SSL certificate providers, but for everything you need to be settled by a third party like hosting, developing and other services. In the most of industries, there are fake people whose main object is to earn money in a corrupt way. In SSL industry, there are fake identities who issues malicious certificate or less encrypted certificate to users that spoils the impression of a website.So do a little bit of homework before buying SSL security for your business. Trustworthy service providers also add some good reputation to your website. And when it comes to security, reputation matters a lot. This creates an impression of safe surfing among your visitors which ultimately increases your business reputation too.

Check compatibility before installing the certificate:
The certificate that you purchase to secure your web site must be digitally signed by another certificate that is already in the trusted store of your user’s web browsers. By doing this, the web browser will automatically trust your certificate because it is issued by someone that it already trusts. If it isn’t signed by a trusted root certificate, or if links in the certificate chain are missing, then the web browser will give a warning message that the web site may not be trusted.
So browser compatibility means that the certificate you buy is signed by a root certificate that is already trusted by most web browsers that your customers may be using. Unless otherwise noted, the certificates from all major certificate providers listed on SSL Shopper are compatible with 99% of all browsers.

Follow a proper installation guide:
Utmost care should be taken while performing the installation. You have to follow each step carefully. Some people do not wait to read what it says and abruptly keep on clicking ‘Next’ and ‘Yes’. This is not the right way to do installation even for any software product. Reading each step carefully not only installs the product properly but also makes you aware of what it takes for installing the product which in turn will; help you in case of trouble in future.

Wrappingit Up
SSL is a powerful tool for protecting your website user’s data, but more than that, SSL builds confidence in those who use your website and help build your online business and reputation. It’s the first thing a user will look for when deciding whether or not to trust a site, but it doesn’t cover all the security issues. It’s just one aspect of a greater effort. SSL protects data during one specific period of time, but that time isn’t the only window of opportunity that an attacker has to strike. Proper installation must be done to ensure that when you employ SSL you don’t render it redundant by neglecting to examine your systems for weaknesses in other key areas. It should never be assumed that a system is secure simply because it uses an SSL certificate or that security issues can be so limited to very few factors such as SSL, website owners should see internet security as something that should be continuously evaluated, seeking to identify weaknesses and eliminating them.

Further reading:

What Next After a Successful SSL Installation

Once your SSL is successfully installed, you need to enable it for your website. We will take a brief look at how to enable SSL on some common and popular content management systems (CMSs).

How to Enable SSL on a WordPress Website

If you are starting a new site and/or want to use HTTPS everywhere on your site, then you need to update your site URL.

You can do this by going to Settings » General and updating your WordPress and site URL address fields.

updating-urls

If your site is already running and want to add SSL, then you need to setup WordPress SSL redirect from HTTP to HTTPS.

You can do this by adding the following code in your .htaccess file:

1 <IfModule mod_rewrite.c>
2 RewriteEngine On
3 RewriteCond %{SERVER_PORT} 80
4 RewriteRule ^(.*)$ https://www.yoursite.com/$1 [R,L]
5 </IfModule>

Don’t forget to replace yoursite.com with your actual site URL.

How to Enable SSL in Joomla

To get SSL Certificate enabled for your Joomla site, you should have these followings in advance.

    SSL Certificate, which has been installed successfully on your server. Note that with most modern servers, as you have on Todhost.com, a dedicated IP address is no longer required to setup/install an SSL certificate for your site..

2. Enable Force SSL in your Joomla site

Note: we used Joomla 3 in this tutorial, for Joomla 2.5, it’s the same. Now let's look at the steps in more detail

Step 1: configure your configuration.php file

Open your configuration.php file

Find the following line:

    var $live_site ='';

Replace with:

    var $live_site = 'https://www.your-domain-name.com';

Remember to replace "your-domain-name" with your actual domain name.

Next, open .htaccess file then add the following code to the bottom of the file.

    RewriteEngine On
    RewriteCond %{HTTPS} OFF
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Step 2: enable Force SSL in your Joomla site

In the Admin Panel, navigate to System >> Global Configuration or simply click the Global Configuration button.

Access Global Configuration in the back-end setting

Within the Server tab, in the Server Settings section, there are 3 Force SSL alternatives that you can select, namely:

    None: SSL will not be enabled in your Joomla site.
    Administrator Only: connections to your administrator will be on HTTPS.
    Entire Site: connections all over your website will be on HTTPS.

Click the Apply/Save button. You are done now! So let's check your site now.

Further reading: