What is SSL?
The SSL (and TLS) protocol stands for Secure Sockets Layer and is the Web standard for encrypting communications between users and websites, such as an e-commerce site. Data sent via an SSL connection is protected by encryption, a mechanism that prevents eavesdropping and tampering with any transmitted data. SSL provides businesses and consumers with the confidence that private data sent to a Web site, such as credit card numbers, is kept confidential. Web server certificates (also known as secure server certificates or SSL certificates) are required to initialize an SSL session.
Customers know a website is protected with an SSL certificate when their browser displays a little gold padlock and the address bar begins with an https:// rather than http://. Higher-end SSL certificates, known as EV (extended validation) certificates, are identified by a green address bar, which adds even more security and trust to a website. SSL certificates can be used on webservers for Internet security and mailservers such as IMAP, POP3, and SMTP for mail collection/sending security.
What is a Single Root SSL Certificate?
When connecting to a webserver over SSL, the visitor's browser decides whether or not to trust the website's SSL certificate based on which Certification Authority (CA) has issued the actual SSL certificate. To determine this, the browser looks at its list of trusted issuing authorities - represented by a collection of Trusted Root CA certificates added into the browser by the browser vendor (such as Microsoft or Netscape).
Most SSL certificates are issued by CAs who own and use their own Trusted Root CA certificates, such as those issued by GeoTrust and RapidSSL.com. Because both GeoTrust and RapidSSL.com are known to browser vendors as trusted issuing authorities, their Trusted Root CA certificates have already been added to all popular browsers, and hence are already trusted. These SSL certificates are known as "single root" SSL certificates. For example, RapidSSL.com, a subsidiary of GeoTrust, owns the Equifax root used to issue its certificates.
What is a Chained Root SSL Certificate?
Some Certification Authorities do not have a Trusted Root CA certificate present in browsers, or do not use the root they own, and use a "chained root" in order for their SSL certificates to be trusted. Essentially, a CA with a Trusted Root CA certificate issues a "chained" certificate which "inherits" the browser recognition of the Trusted Root CA. These SSL certificates are known as "chained root" SSL certificates.
Installation of chained root certificates is more complex and some web servers and applications are not compatible with chained root certificates.
If a Certification Authority has and uses its own Trusted Root CA certificate that is already present in browsers, this is a clear sign that the CA has been in the industry for a long-time, is stable, and credible, with long term relationships with many reputable browser vendors (such as Microsoft and Netscape). For this reason, such CAs are seen as being considerably more credible and trustworthy than chained root certificate providers who do not have a direct relationship with the browser vendors, or do not use their own root certificates to issue SSL certificates.
You can view the Certification Authorities who have and use their own root certificates by viewing the list in your browser. Chained root certificates require additional effort to install as the webserver must also have the chained root installed. This is not necessary for single root certificates.
Why is stability important for SSL certificates?
The more stable an SSL certificate is, the more trust it can add to a website, which means customers are more likely to be comfortable conducting a transaction online. All of our SSL certificates are issued from a globally trusted CA root certificate such as Comodo or Symantec/VeriSign/Equifax/GeoTrust/etc. This means that all our certificates are stable.
What do you consider a low volume, low transaction website?
As a general rule, we consider a low volume, low transaction website to be when typical customer transaction value is less that $50 USD per week, and volumes of transactions are less than 50 per week*.
If you have a low volume website and you decide that your customer's confidence is not affected at all by the brand behind the SSL certificate, then RapidSSL is the perfect answer.It is all about customer confidence. Whilst RapidSSL technology is production grade, only you can determine whether your customer’s confidence will improve significantly if you purchase a more established brand like GeoTrust.
*The 50 per week figure is simply a commercial guide and not a technical restriction. Technically speaking, the RapidSSL certificate will not be restricted from conducting more transactions than 50 - they are still industry standard 128 / 256 bit SSL certificates. However it is our professional opinion that sites conducting more than 50 transactions per week will require a Professional Level SSL certificate due to the increased likelihood that the website's customers will expect SSL from a highly credible and established SSL provider, along with a well-known, internationally accepted SSL brand.
What is browser ubiquity or browser recognition?
Browser ubiquity is the term used in the industry to describe the estimated percentage of Internet users that will inherently trust an SSL certificate. The lower the browser ubiquity, the less people will trust your certificate. If you are operating a commercial site, you would like as many people as possible to trust your SSL certificate. As a general rule, any SSL certificate with more than 95% browser ubiquity is acceptable for a commercial site.
Ubiquity is, however, not the only consideration in deciding whether one SSL certificate is better than another. Many companies running high-transaction, high-volume web sites need to maximize customer confidence and, therefore, purchase certificates from well-known, experienced security vendors who are all WebTrust compliant, like GeoTrust and Verisign.
If you have a low-volume website (less than 50 transactions per week) and you decide that your customers’ confidence is not affected at all by the brand behind the SSL certificate then RapidSSL or RapidSSL Wildcard certificates are the perfect solution.
Can I secure multiple subdomains with a single SSL Certificate?
An SSL certificate is issued to a fully qualified domain name (FQDN). This means that an SSL certificate issued to "secure.rapidsslonline.com" cannot be used on different subdomains, such as "www.rapidsslonline.com". To get around this restriction, we have Wildcard Certificates available. Wildcard SSL Certificates allow you to secure multiple subdomains on the same domain name, thereby saving you both time and money. And, of course, you do not need to manage multiple certificates on the same server.
So with a single certificate issued to “.yourdomain.com,” you could protect:
- www.yourdomain.com
- secure.yourdomain.com
- etc.yourdomain.com
How does a server certificate work?
The end-user's browser requests a secure channel (via "https:") from the server, and then - if the server has an SSL certificate - the browser and the server negotiate their highest common encryption strength (e.g., 128-bits), and then exchange the corresponding encryption keys (this exchange is normally done using 1024-bit encryption strength). The 128-bit encryption key is then used for this particular instance of SSL, for all from-to exchanges between the browser and the server. The next https session will have a new session key.
The certificate guarantees the security of the connection between the browser and the server. Once data is in the server, it is up to the server admin to make sure the data remains protected.
What are AS1 and AS2 standards?
AS2 (Applicability Statement 2) is a specification for Electronic Data Interchange (EDI) between businesses using the Internet's Web page protocol, the Hypertext Transfer Protocol (HTTP). The specification is an extension of the earlier version, AS1 (Applicability Statement 1). Both specifications were created by EDI over the Internet (EDIINT), a working group of the Internet Engineering Task Force (IETF) that develops secure and reliable business communications standards.
The AS2 standard provides Secure Multi-Purpose Internet Mail Extensions (S/MIME) and uses HTTP or a more secure version, HTTPS, to transmit data over the Internet. AS1 uses a slower protocol, SMTP (Simple Mail Transfer Protocol). The use of HTTP or HTTPS allows communication in real-time rather than through email delivery. Security, authentication, message integrity, and privacy are assured by the use of encryption and digital signatures. Another important feature, no repudiation, makes it impossible for the intended recipient of a message to deny having received it.
The AS2 standard allows businesses to use a common, single communications solution. This eliminates the complications and costs involved when different businesses in a network use different transfer protocols. A Web server, an EDI transfer engine, and digital certificates are required for data exchange using AS2. Almost any type of data can be transmitted.AS1 is based on IETF RFC 3335 and AS2 is based on RFC 1767.
What is the encryption strength of GeoTrust certificates?
All GeoTrust certificates are 128-bit. During each and every session, the server and browser negotiate and choose the highest common encryption strength between them. So, if a 40-bit browser user hits your SSL-secured site, the resulting connection will automatically become a 40-bit strength encryption.
GeoTrust recommends that end-user Subscribers select the 1024-bit encryption strength or the equivalent descriptor option when generating their certificate requests. When the certificate's key length is 1024 or longer, the SSL session key will be 128 bit. If the certificate key length is 512, the SSL session key will be 40 bit or 56 bit.
If you are running Windows, see Microsoft's bulletin Q300398: "You install a 128-bit high encryption certificate onto Internet Information Server (IIS) version 4.0 or 5.0, then browse with a 128-bit enabled Web browser to IIS by using https://. However, the Web browser only makes a 40-bit or 56-bit Secure Sockets Layer (SSL) session with IIS (size 7927 bytes, updated 6/13/2001 12:54:00 PM GMT)."
How do I check if a 128-bit encryption is being used?
- For Microsoft Internet Explorer
Move the mouse over the "security lock icon" at the bottom-right corner of the screen. A tool-tip of "SSL secured (128-bit)" should pop-up or you can just right-click any text on a page (not on a graphics object) and select "Properties." "Connection" with "SSL 3.0, RC4 with 128-bit encryption (High); RSA with 1024-bit exchange" is shown or Press "File" in the toolbar and select "Properties." "Connection" with "SSL 3.0, RC4 with 128-bit encryption (High); RSA with 1024-bit exchange" is shown.
- For Netscape Navigator
"Security" with "This is a secure document that uses a high-grade encryption key for U.S. domestic use only (RC4, 128-bit)" is displayed if you press "Security" in the toolbar. Then, a "Security Info" window will be displayed. Click "open page info" or right-click any text on a page (not on a graphic object) and select "View Info".
A Step by Step Guide to Receiving your Certificate:
When you have successfully completed the payment and order, we will send an Approver email to the designated APPROVER email address as you have registered during the order submission. You would have selected the Approver email address during enrollment. This would either be:
- The email address associated with your WHOIS contact (if you are unsure, you can check this address by searching the WHOIS database at www.nic.com)
- A generic email address such as
- administrator@yourdomain.com
- webmaster@yourdomain.como
- admin@yourdomain.com
- ssladmin@yourdomain.com
- root@yourdomain.com
- hostmaster@yourdomain.com
- postmaster@yourdomain.com
Unless the Approver receives this email and approves the application by clicking on the link within the email, your certificate cannot be issued. If you are the administrator of the Approver email address, please check any spam filters and virus protection folders in case the email has been quarantined.
We strongly recommend whitelisting the email addresses below if you are using a SPAM filter.
For the CAs:
Symantec
- support@symantec.com
- sslorders@symantec.com
- support@geotrust.com
- sslorders@geotrust.com
Comodo
- support@comodo.com
- sslorders@comodo.com
For the SSL provider:
- sales@[domain name].com
- support@[domain name].com
