Importance of SSL Certificate and How to Install it on a WordPress Hosting Plan

What is an SSL Certificate?

Have you ever wondered why many websites start with “http://” while others with “https://”? Simply put, the “s” in the latter indicates that the site is secure and is using an encrypted and secure connection through an SSL (Secure Socket Layer) Certificate. In 2016, Google announced that it had made certificate transparency mandatory for Chrome web browsing. Certificate Transparency is an open-source framework designed by Google. It is used for monitoring and auditing the domain certificates sites use to establish authenticity with browsers. Google flags websites that use ‘http://’ which indicates that the connection between the client and server is not secure. Websites that begin with “https://” are secure, and Google indicates it in the browser using an indicator. Furthermore, Google ranks sites that begin with “https://” higher than others that don’t follow this protocol.

Secure (https://)

Not Secure (http://)

So, what is an SSL (Secure Socket Layer) certificate? It is a digital certificate that validates the identity of any website, coupling together the company name, location and domain name with a unique cryptographic key.

Why do you need an SSL certificate?

SSL plays a significant role in protecting any website. It protects the sensitive information stored on and exchanged with the site and acts as the backbone of the secured network. Even if the website is not handling any sensitive information like Credit Card details, it provides critical security and privacy to both user and the website. Whether you are an average blogger or an ecommerce store, whether you use a CMS like WordPress, Drupal or a custom-built website, you need an SSL to establish credibility. Buying an SSL certificate is recommended when a user is purchasing different WordPress Hosting Plans.

• It Encrypts Sensitive Information – Encryption is a process of encoding data into a form, named a cipher text to prevent unauthorized access. Since encrypted data cannot be read by unauthorized individuals, it makes the connection secure between the client and the server. Keys are used to control the operation of a cipher so that only the correct key can convert encrypted text to plain text. Key lengths indicate the number of bits contained in a certain cryptographic key or related arithmetic structure. They are a measure of the security that may be attained. Bits build the key size; bits can be 40-bit, 56-bit, 128-bit, 256-bit. 40-bit and 56-bit encryption are vulnerable to brute force attacks, and are therefore cannot be regarded as secure. Key lengths of 128 and 256 bits are considered secure and safe from brute force attacks.

The primary reason behind SSL is to keep sensitive data encrypted so that only the intended receiver can understand it. Any information that is sent on the internet passes from computer to computer to reach its destination server. If not encrypted with SSL certificate, any computer between the destination server and your computer can easily see critical information like username, password, credit card numbers and more. However, with an SSL certificate, all this information is safe to travel across computer networks around the world.

• SSL is required for Payment Card Industry (PCI) compliance – If you own a website with a payment gateway, to accept credit card information, SSL certificate is necessary. Also, the site needs to pass certain audits as well that indicate it is complying with the Payment Card Industry (PCI) standards.

• It Builds Trust – Any visitor browsing your site will instantly get to know that their connection is secure through the lock icon or a green address bar in the URL. This will build trust which will be good for your business.

Things to Know Before Installing an SSL Certificate

Linux

• Multiple SSL Certificates with SNI

Servers with cPanel versions 11.38 and above can utilize Server Name Indication (SNI) to allow a server to exhibit multiple certificates on the same IP address and port number. It allows multiple secure (HTTPS) websites (or any other Service over Transport Security Layer) to be served off the same IP address without requiring all those sites to use the same certificate.

Linux and Windows

• SSL Requires a Dedicated IP Address

A private SSL certificate requires its own dedicated IP address.

• Changing to a Dedicated IP Address requires time to propagate

When switching to a dedicated IP, the internet protocol address of your website will change, and the DNS will subsequently need to spread (update) worldwide, which requires 4 to 8 hours.

• SSL Certificates are issued on an annual basis

SSL Certificates are usually purchased with a 1-year expiration date, although multi-year SSL certificates are also available with some WordPress Hosting plans providers. Before a certificate expires, users will need to purchase a new SSL certificate which will have a new expiration date.

• Only One SSL Certificate per cPanel account

Only one SSL Certificate can be installed per cPanel account.

• Users have more than one domain or subdomain on an SSL Certificate

SSL Certificates can be issued for more than one domain or subdomain using a variant known as Wildcard certificate

How to Install SSL Certificate on a WordPress Hosting Plan

• Generate a Certificate Signing Request (CSR)

Generate a CSR before you apply for a SSL certificate. This can be done from your web server control panel. You will need to fill the following details –

• Organization Name

• Organizational Unit (The type of your organization, for example: sole proprietorship, Public company, Private company, etc.)

• Country Code

• State or Province

• Locality

• Common Name (The domain name for which you need an SSL Certificate)

Generating a CSR will depend on the web server and control panel you are using –

Here’s how you can generate a CSR on the two most popular control panels –

cPanel

Plesk

• Locate Your SSL Certificate

Once the service provider has issued you the SSL certificate, it can be easily found in your Control Panel with the steps mentioned below:

Step 1 – Login to your Control Panel

Step 2 – Navigate to the Order Information View

Type the Domain Name of the order in the search field on the homepage, select Order from the drop down and click on the Search button.

Step 3 – Retrieve your SSL Certificate

In the Order Information view, click on View certificate details. A pop up will display your certificate.

• Install Your SSL Certificate

If you want to use HTTPS everywhere on your website, then you need to update the URL of your site. You can do this by going to Settings » General and updating your WordPress and site URL address fields.

For an Apache server

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
</IfModule>

For nginx servers:

server {
listen 80;
server_name yoursite.com www.yoursite.com;
return 301 https://yoursite.com$request_uri;
}

To add SSL and HTTPS on your WordPress multi-site admin area and login pages, you need to configure SSL in the wp-config.php file.
Insert the following code just above the “That’s all, stop editing” line in the wp-config.php file

define('FORCE_SSL_ADMIN', true);

How to Install SSL Certificate on a WordPress Hosting Plan without cPanel Access

If your WordPress website comes without a cPanel access, then follow the steps below to install a SSL certificate –

1. Login to your WordPress hosting control panel and click on Manage SSL.

2. Click on the link to Generate or View Certificate Signing Request to generate a CSR.

3. Fill the required details and click on Click to Generate CSR.

4. Use the generated CSR to issue a digital certificate from your certificate provider.

5. After you have received the digital certificate, click on Install a valid Digital Certificate to install it.

6. Click on the link next to Activate Certificate to activate the certificate.

Conclusion

Setting up a WordPress SSL is less troublesome than most people anticipate. An SSL Certificate is a worthy investment for your online business. It ensures your users and consumers that the information between your website and their system is encrypted and secure. Not only does an SSL certificate retain more customers, but it is also a foundation of building trust. With an SSL certificate, the users on your website will feel secure about submitting their confidential information like email address and credit card details. By securing your website, your clients will feel much safer transacting on your website and lead them to become trusting followers in the long run.