What is SSL (the little padlock)?

SSL (?Secured Socket Layer?) is a protocol used to encrypt the communication between the user's browser and the web server. When SSL is active, a ?little padlock? appears on the user's browser, usually in the status line at the bottom (at the top for Mac/Safari users.)

This assures the user that sensitive data (such as credit card numbers) can't be viewed by anyone ?sniffing? the network connection (which is an increasing risk as more people use wireless networking).

Common web site owner questions about SSL:

How do I get the little padlock on my site?

To get the little padlock, your site must have an SSL Certificate from a Certificate Authority. Once an SSL Certificate has been purchased and installed, it provides three things:

Once obtained, the certificate must be installed on the web server by your web host. Since your web host also has to generate an initial cypher key to obtain the certificate, very often they will offer to handle the process of obtaining the certificate for you.

My web host has a ?shared certificate? that I can use. Should I?

It's still fairly common for small sites to use a shared certificate from the host. In this circumstance, when a page needs to be shown in secured mode, the user is actually sent to a domain owned by the web host, and then back to the originating domain afterwards.

A few years ago, when SSL Certificates were quite expensive (around $400 per year), this was real attractive for new sites just getting their feet wet in e-commerce. Today, with a number of perfectly functional SSL certificates available for under $100 (exclusive of installation, etc.), it is a lot less attractive. Since your user can look a the address line of his or her web browser and see that the site asking for the credit card number is not the site he or she thought they were on, the cost savings is probably not worth the risk of scaring off a sale.

What's the difference between the expensive SSL Certificates and the inexpensive ones?

Usually, mostly price. Some expensive certificates have specific functions, like securing a number of different subdomains simultaneously (a ?wildcard? certificate), but the effective differences between basic single site certificates are very slight, despite the wide range of prices:

The encryption mechanism used by all of them is the same, and most use the same key length (which is an indicator of the strength of the encryption) common to most browsers (128 bit).

Some of them (?chained root? certificates) are slightly more of a pain for your web host to install than others (?single root? certificates), but this is pretty much invisible to the site owner.

The amount of actual checking on the ownership of the domain varies wildly between vendors, with some (usually the more expensive) wanting significant documentation (like a D&B number), and others handling it with an automated phone call (?press #123 if you've just ordered a certificate?).

Some of them offer massive monetary guarantees as to their security (we'll pay you oodles of dollars if someone cracks this code), but since it's all the same encryption mechanism, if someone comes up with a crack, all e-commerce sites will be scrambling, and the odds of that vendor actually having enough cash to pay all of its customers their oodle is probably slim.

The fact is that you are buying the certificate to insure the safety of the user's data, and to make the user confident that his or her data is secure. For the vast majority of users, simply having the little padlock show up is all they are looking for. There are exceptions (I have a client in the bank software business, and they feel that their customers (bank officers) are looking for a specific premier name on the SSL certificate, so are happy to continue using the expensive one), but most e-commerce customers do not pick their sellers based on who issued their SSL Certificates.

My advice is to buy the cheaper one.

I have an SSL certificate -- why shouldn't I serve all my pages in ?Secured? mode?

Because SSL has an overhead -- more data is sent with a page that is encrypted than a page that isn't. This translates to your site appearing to run slower, particularly for users who are on dial-up or other slow connections. Since this also increases the total amount of data transfered by your site, if your web host charges by transfer volume (or has an overage fee, as most do), this can increase the size of your monthly hosting bill.

The server should go into secure mode when asking a user for financial or other sensitive data (which may well be ?name, address and phone number?, with today's risk of identity theft), and operate in normal mode otherwise.

Updates to this article, and many other great articles and tutorials for small business web site owners can be found at Insanely Great Sites!

More Ecommerce Articles

Online Lead Generation: Can it Work for My Business?
Business-to-business service providers have a wide range of tactics they can deploy to gain new clients or customers. Direct mail; cold calling; TV, radio or print advertising are all ways in which B2B services gain new customers.

6 Steps to Attracting Black Customers Online
by Jamila White, "The E-Commerce Diva"In the rush to keep up with technology, many African-American business owners are so busy trying to add the latest bells and whistles to their Web sites, get to the top of the search engines, and learn the latest database technology that they often forget this simple fact: people do business with other *people*, not computers. Understanding the importance of relationships is key to attracting African-American buyers online.

How To Sell Your Products Online?
E-commerce is gaining pace! Research firm eMarketer predicts that 2003 will see online sales reaching US $58.2 billion excluding travel.

Doing Business Online ? Private B2B Exchanges
Business processes are the building blocks of an enterprise. If one of these processes fails to live up to its expectation, business starts to flounder.

Grow your Business with Emarketplace - Part III
Increase Company ProductivityAfter years of hard work, finally your business started to pick up. You are selling more products then ever! You have lined up a good number of suppliers and buyers.

Grow Your Business Using B2B Emarketplace ? Part II
Selecting the right emarketplaceAlthough, IT spending has been staying flat for the last several years, corporate spending in e-business is gaining significant ground and at present surpasses 20 percent of overall IT budget.This means, more and more businesses are undertaking ecommerce initiatives, and as a result increasing sales, streamlining business processes and dramatically boosting productivity.

Grow Your Business Using B2B Emarketplace - Part I
If you are a small to medium size company and selling or planning to sell products and services over the Net and still did not try out emarketplaces, you are simply loosing a great opportunity!Research firm eMarketer predicts that worldwide B2B ecommerce revenues will surpass US$ 1.4 trillion by the end of 2003.

Retirement Signature Frames ? The Perfect Retirement Gift!
When most people think of a retirement gift, they think of a watch. It?s the tried and true gift that companies give employees to say thanks for all the years of hard work.

The Plain Man?s Guide to Making Money Online
I?m a plain man who uses plain thinking in devising strategies for making money online.I do not spend obscene mounts of money attending high ticket web conferences nor do I rush to purchase the latest collection of web casts at outrageous prices.

Leveraging Open Source Technology
Open Source applications can bring unique value to business owners. Since the base application development costs of open source applications is free, small and medium business owners are able to leverage previously unobtainable technolgies against their sales objectives, operational costs and customer satisfaction levels.