Website Security

Secure Sockets Layer (SSL) is a protocol for website security. It protects online communication and transactions using the strongest encryption available. An SSL certificate validates the identity of your website, rather like a passport. Once activated it displays a padlock icon and https:// in your URL. These trust indicators let your customers know that your site is genuine, protected, and private.

It encrypts everything sent between your site and your visitor, so card numbers, logins and personal details cannot be read in transit. Google also treats HTTPS as a ranking signal.

All of them, but some sites are more vulnerable than others such as financial institutions, big-name brands, and government entities. You must use SSL protection if your website is PCI compliant and accepts payment cards, or does any of the following:

• Banking sites asking for financial information.
• If your website accepts payment cards (American Express, Diners Club International, MasterCard, Visa.
• Including credit, debit, prepaid, and gift cards), you have to comply with the credit card associations’ rules about data security. The goal being to protect cardholder data. This has been standardised under the Payment Card Industry Data Security Standard (PCI DSS). If you don’t use an SSL certificate on your website, you won’t be complying with the PCI standards.
• Your website asks customers to provide personal or sensitive information such as email addresses, social security numbers, medical records, and passport numbers.
• You have login forms on your website asking users to enter their username and password.
• Your site provides webmail where users can login and read email in a secure environment.
• There are subscription pages for newsletters, mailing lists, etc.

The wildcard applies to the PositiveSSL DV, Domain, and Organisation SSL certificates. The certificates are issued for the domain name specified in the initial application. If you buy a wildcard with one of these three certificates, it means that the common name specified is *.yourdomainname.com. You can then use the certificate on an unlimited number of subdomains and servers. You also have the option to add in the future.

If you need to secure multiple subdomains on a single domain name, you can buy a wildcard. For a wildcard SSL certificate, a common name of *.yourdomainname.com would secure www.yourdomainname.com, mail.yourdomainname.com, secure.yourdomainname.com, etc…

To complete the application for your SSL certificate you need to generate a CSR and submit it to our Certificate Authority (CA). The CSR contains text that’s been encrypted and includes details of your application: company name, domain name, location, email address. Plus, your public and private keys will be generated. Your public/private keys are for encrypting/decrypting all online communication and transactions between you and your customers. To ensure your website traffic stays secure, you must keep your private key a secret. Once our CA receives and confirms your details, it will issue your SSL certificate.

Our Certificate Authority provides an SSL certificate Request Helper which will create your CSR. This tool allows you to generate the CSR for OpenSSL, Microsoft Exchange 2007, Microsoft Exchange 2010, Java Keytool, F5 Big-IP, and Microsoft IIS

Please note that if you’re generating a CSR for a wildcard SSL certificate, your common name must start with an asterisk (*), i.e., *.yourbusiness.com.au. The asterisk represents any subdomain name.

Every SSL certificate carries a digital signature generated by a hashing algorithm, which proves the certificate has not been altered. SHA-1 is no longer secure and triggers browser warnings. All our certificates use SHA-2.

EV validation is manual. A person at Sectigo verifies your company's registration, address and phone number against public records, which takes about a day.

The free Let's Encrypt certificate encrypts traffic and shows the padlock, which is enough for most brochure sites. A paid certificate adds a warranty of up to $1.75 million, validates that your organisation is real rather than just the domain, and gives you a support path if something goes wrong. If you take payments or handle sensitive data, the validation and the warranty are worth paying for.

It covers your customers, not you. If the certificate is mis-issued and someone loses money because of it, the warranty is what pays them. It is a measure of how much the certificate authority stands behind its validation, which is why higher validation levels carry higher figures.

PositiveSSL for a brochure site that just needs the padlock. Domain SSL if you want a larger warranty at domain validation level. Organisation SSL if you want your company name verified in the certificate. Extended SSL for banks, government suppliers and anyone whose customers check who they are dealing with. Add wildcard if you run subdomains such as shop. or portal.

Installation is not included, but you can add it at checkout. It costs $27.50 if the site is hosted with Domain Central and $55 if it is hosted elsewhere.