SSL certificates

[HobbyMounts]

This is a pretty broad question really.

I'm in the middle of choosing a merchant account and a payment gateway.

Will I also need an SSL certificate from my host?

If so, will the merchant account provider and/or the payment gateway provider require this before opening up an account with either of them?

Also, which type will I need?

Thanks in advance.

 

[Faevilangel]

You will get an ssl certificate, either to show you take security properly or the payment system requires it.

Your payment requirement will be down to how you set the payments up.

Sent from my HTC One SV using UK Business Forums

 

[ServWise]

Your payment provider will usually tell you if you NEED an SSL, in cases where the credit card data is processed on your own site you will, you would probably want one anyway just so customers feel secure entering in personal information in any case.

You do not need to purchase your SSL from your host (unless they insist on it), all you need is a CSR generated from the host machine which you submit after you order an SSL from any SSL provider, we sell ssl's from as little as £10.00/y

As for the type of ssl, well most all SSLs secure to exactly the same level, the differences are to do with the level of assurance (Trust) so that an SSL from say Symantec (Verisign) will have more associated trust then say one from Comodo, SSLs like EV (Extended Validation) also give a visual indication with a green address bar to draw the attention of the customer to the fact an SSL is used.

I have a blog post about this subject if you want to take a look. http://www.servwise.com/blog-sam/index.php/2008/06/24/got-website-need-ssl/

regards

 

[14Steve14]

I would like to think that you would have an SSL any way just for customer peace of mind. It is recommended that if you are collecting and storing any customer data you should have an ssl installed. They are not that expensive.

 

[DavidHorn]

Whether you need an SSL or not will depend on where the transaction takes place.

If credit card information is entered on your site - and then sent to the payment gateway for processing - then yes, you'll need an SSL.

Many payment providers offer a service which takes the visitor off of your site, and on to their own site to enter card details and process payments. This site can often be branded to offer a more seamless experience for the customer. That's a good way to go since the payment provider is then responsible for all the legal technicalities involved in payment processing.

If you require an SSL you will likely need that in place before connecting with the payment gateway since they'll require a secure connection in order to run successful tests on your set up.

Hope this helps!

David

 

[cameroncruz]

yes, its necessary to have SSL if you gathered important information or credit card details from your customers.

 

[HobbyMounts]

Great, thanks. Really helpful. I'll get one anyway, regardless but I'll also ask whichever gateway provider I go with if the payment details are taken off-site, so to speak.

One question, if I buy the SSL from somewhere other than my host, how to I install it?

 

[Faevilangel]

You will need top speak to your host as each one will have different ways, depending on their server and software

 

[Optegris]

I would like to think that you would have an SSL any way just for customer peace of mind. It is recommended that if you are collecting and storing any customer data you should have an ssl installed. They are not that expensive.

Collecting yes but having a SSL cert makes bugger all difference when it comes to storage of data. It only encrypts the transmission not the stored information.

Great, thanks. Really helpful. I'll get one anyway, regardless but I'll also ask whichever gateway provider I go with if the payment details are taken off-site, so to speak.

One question, if I buy the SSL from somewhere other than my host, how to I install it?

As above, your host will advise but the basic steps are:

1) Obtain a CSR (Certificate Signing Request) from you host
2) Purchase the certificate and supply the CSR to the vendor
3) Install the certificate or send it to your host to do.

Note the host will need to provide you with a fixed IP address for the certificate.

<geek note>
I know it's technically possible to install without a fixed IP but this is not widely supported.
</geek note>

 

[HobbyMounts]

Thanks again.

I host with Vidahost who to be fair are very good so I might just buy from them.

Something like this at £39 PA including installation maybe?

https://www.vidahost.com/page/ssl-certificates

 

[Faevilangel]

Thanks again.

I host with Vidahost who to be fair are very good so I might just buy from them.

Something like this at £39 PA including installation maybe?

https://www.vidahost.com/page/ssl-certificates

I use this on 2 clients sites and it works seamlessly, normally activated within a couple of hours.

If you know someone on VH, they can give you a 20% off discount on SSL certificates (bringing it down to around £31+vat)

 

[Optegris]

VH are good and it's probably not worth hunting around for a cheaper solution as you would pay the install fee as well as the certificate from elsewhere...

 

[HobbyMounts]

Not sure I know anyone well enough on VH, I think Dom is a member on here though isn't he?

"Hey Dom ;-) ;-)"

 

[DavidHorn]

£39 per year with installation is perfectly reasonable cost. And keeping it with your hosting company simplifies support as well - so makes perfect sense.

 

[anthonyUK]

Collecting yes but having a SSL cert makes bugger all difference when it comes to storage of data. It only encrypts the transmission not the stored information.

As above, your host will advise but the basic steps are:

1) Obtain a CSR (Certificate Signing Request) from you host
2) Purchase the certificate and supply the CSR to the vendor
3) Install the certificate or send it to your host to do.

Note the host will need to provide you with a fixed IP address for the certificate.

<geek note>
I know it's technically possible to install without a fixed IP but this is not widely supported.
</geek note>

This guy is right, I went through all of these things!