Secure Socket Layer (SSL) is a protocol developed by Netscape in 1996, which quickly became the method of choice for securing data transmissions across the Internet. SSL is an integral part of most web browsers and web servers and makes use of the public-and-private key encryption system developed by Rivest, Shamir, and Adleman.
In order to make an SSL connection, the SSL protocol requires that a server should have a digital certificate installed. A digital certificate is an electronic file that uniquely identifies individuals and servers. Digital certificates serve as a kind of digital passport or credential which authenticate the server prior to the SSL session being established.
Typically, digital certificates are signed by an independent and trusted third party to ensure their validity. The “signer” of a certificate is known as a Certification Authority (CA), such as VeriSign, Thawte, and GeoTrust.
SSL certificates help solve two main online security problems:
Solving these security problems allows online business to protect against the following scenarios:
Firstly, looking at categories of data, the most common deployment is for securing transmission of financial information in e-commerce. However, with incidence of identity theft on the rise, protecting the transmission of a broad range of personally identifiable information is becoming ever more important. This category of data would include identity and social security numbers, e-mail addresses and demographic information as well as account registration and login information.
In terms of applications and protocols, SSL Certificates can be used to secure the following:
Not all SSL Certificates are created equal. Some SSL Certificates are from ROOT companies, like GeoTrust or VeriSign, and will work in any browser, no matter how old the computer is. Some of the newer or off-brands do not work in every browser and do not work in order computers – instead, they give the user a popup that says the SSL certificate is invalid.
The first type of certificate is Basic SSL certificate, which just gives you the encryption and makes your website show up secure in the browser so you can perform secure connections online.
The second type of SSL certificate requires the certificate authority (the company issuing the certificate, such as GeoTrust or VeriSign) to verify the purchaser’s business and their authority to purchase a certificate on behalf of that company. Basic SSL certificates only verify the domain ownership of the purchaser, and thus have much faster turnaround times since none of the additional information needs to be verified.
The third type of SSL certificate is the most expensive, and requires more investigation of your company. You have to be a corporation in order to purchase this kind of certificate. For all the extra research into your company, the top bar in IE turns green, to let visitors know it is safe.