HTTPS Protocol and SSL Certificate

Google Chrome Wants You on HTTPS Only

Thinking about getting an SSL certificate? Now is the time.

Many people think it's a minor detail; few realise that pairing a SSL certificate with your website guarantees maximum browsing security, thanks to the HTTPS protocol.

What Does SSL Mean?

SSL stands for Secure Socket Layer, a protocol whose job is to protect the exchange of information between a browser and a server, for example by encrypting the data exchanged by users. Sensitive data held on a server can, in fact, be intercepted by real attackers precisely during the transfer between browser and server.

What counts as sensitive data?

• Registration data: name, address, email address, phone number

• Login data: email address and password

• Payment information: credit card numbers, bank details

• Registration forms

• Documents uploaded by customers

With the SSL protocol, you make sure communication cannot be read or tampered with, and that personal data does not end up in the wrong hands. This is especially critical for e-commerce, where protected and sensitive data is transmitted constantly — using an SSL certificate, or better still its more recent version TLS (Transport Layer Security), is essential.

What Does HTTPS Mean?

HTTPS stands for Hyper Text Transfer Protocol Secure: the protocol that protects the integrity and confidentiality of the data exchanged between computers and websites (the S at the end of HTTPS stands for "secure"). This is because it relies on Transport Layer Security (TLS), which provides three essential layers of protection:

1. Encryption: the data exchanged is encrypted, so no one can track the activity taking place

2. Authentication: HTTPS verifies the parties involved, making sure you are connected to the right person/company/server and not to someone trying to intercept the communication

3. Data integrity: data cannot be altered during transfer without that tampering being detected

What About HTTP?

HTTP is the insecure variant. On websites using HTTP, none of the data is encrypted, so it can easily be intercepted and read by anyone, such as an attacker.

Getting an SSL Certificate

The SSL certificate is a website's identity card, an add-on service that can be requested for any type of domain and hosting. Buying an SSL certificate is recommended for domains linked to e-commerce sites, hotels, hospitality businesses and restaurants with online booking and payment systems, as well as for any domain offering services to the public that collects sensitive information and data that needs careful protection.

There are several types of certificate, differentiated by the level of identity verification involved:

Domain Validated (DV) SSL Certificate - Domain-level validation

DV certificates verify only the internet domain. They can therefore only be requested by the actual owner of the domain. In general, DV certificates are suited to websites where trust and credibility play a secondary role and there is no risk of fraud.

Organisation Validated (OV) SSL Certificate - Organisation-level validation

OV certificates are designed to certify that a site is owned by a company, and help reinforce that company's identity and image. OV SSL certificates can be requested by authorised company representatives, who will be contacted by the provider by both email and phone. OV certificates are suited to websites that do not process transactions involving sensitive data.

Extended Validation (EV) SSL Certificate - Extended validation

EV SSL certificates represent the highest level of security and trustworthiness a website can have. They reassure visitors by displaying the green bar in the browser, often along with the company's full legal name. To issue an EV certificate, the provider carries out checks on the company to confirm it really is who it claims to be. Because of this, issuing the certificate can take up to a week. An EV SSL certificate is necessary for sites with a high volume of transactions involving credit card numbers or other sensitive data.

Security Is an Absolute Priority for Google

This is part of Google's plan, launched in January 2017, to protect the security, privacy and integrity of user data. For some time now, Google has been favouring websites that use the HTTPS protocol (including in search rankings) and flagging all HTTP pages as "not secure" — a warning that is now clearly visible to users browsing these sites and represents a real penalty for the sites in question.

Have You Already Migrated Your Website to HTTPS?

We will continue exploring the gradual rollout of the HTTPS protocol as a relevant ranking factor in Google's search algorithm in a follow-up article.