Secure Socket Layers, SSL is a commonly used protocol that helps the users to encrypt information and hereby enables the users to manage information for security purposes as it is transferred on the Internet.
HostGator hosting plans come with shared SSL certificate or the customer can use private SSL certificate. All HostGator shared hosting plan, except the HostGator hatchling plan, are come with shared SSL certificate for free. HostGator shared SSL is self assigned shared SSL. The secure socket layer (SSL) encryption ensure confidential data of the customer as well as the user info is encrypted before sent over the Internet, be it be its credit card payment information or confidential personal information which includes site login information. Once the customer has SSL setup, it can have HTTPS secure webpage on its website. If the user is running ecommerce online shopping store, it is crucial to have SSL feature. HostGator shared SSL will provide what the user needs to collect credit card information online. Beside that the user can also sign up merchant account with credit card payment processing like 2checkout, paypal, VeriSign, worldpay etc.
HostGator shared hosting is with shared SSL certificate only. Although it is secure method to transfer data online, it is with a pop up and require user to accept the certificate, and hence it is not suitable for ecommerce website or commercial website that require smooth secure checkout page. What the users need is to install private SSL certificate from HostGator hosting, for their domain name. The users can purchase SSL certificate from HostGator for nominal price of $75 per year. And the SSL certificate will be installed for their domain name. It will require private IP address for the domain name too, this will cost the users another $2 per month. After the users have the dedicated IP and private SSL, they are ready to have their own https website for secure online transaction to take place. The SSL cert is installed for their particular domain name only, and it is not shared with other domain website. If they require other website to have https access too, then they need another IP address and another SSL certificate for the second domain.. and so on. There is a third party SSL certificate available for cheaper price, the users can source online for it, for example RapidSSL.
If the customer buys the SSL certificate then it is valid for one year and is non returnable. If the customer does not want to renew its SSL certificate, it can simply allow the certificate to expire. At the time of renewing SSL, it can either purchase or reinstall a new certificate of it to make the application secure. If SSL is bought from HostGator, then the customer need not to worry about its installation or re-installation. If it is bought from another company, then each time he has to reinstall the updated information. If the client is already having the SSL and also change to a new server/host, then he may continue using his existing SSL. Simply he has to install RSA key and certificate codes to the new server. The SSL provider may also allow some of its clients (that is, on request) to purchase a certificate for more than one year. This will reduce the number of times they have to reinstall the SSL on their server. When the SSL certificate is enrolled, the client receives 3 different groups of alphanumeric data; the final CERTIFICATE, the RSA KEY, and possibly a CA BUNDLE. They are sent from the certificate provider
Sign Up for SSL
While signing up for a SSL Certificate, usually a pre SSL Checklist is to be checked for compliance. This Pre SSL Checklist may be as follows:
1. Ensure the Whois information is current and valid.
2. If the client has Domain/Whois Privacy, then it has to either prepare a screen shot of the actual Whois information (from back end) or remove the privacy setting temporarily (not recommended, as the registrar may attempt to charge him to reactivate it).
3. Fill the form and check its fields thoroughly:
* SSL included with Business plan
* SSL purchased separately
4. Order the SSL a few days before using the Internet, just in case there are unforeseen problems that must be faced.
5. If they need the Whois screen shot, they will inform him via email.
Types of SSL
SSL Certificates are mainly of three types namely Shared, Private, and Wild Card SSL.
* Shared SSL uses a HostGator domain and causes certificate’s warning messages to pop up on site screen to prevent from unauthorized access.
* Private SSL (256 bit) will use the domain name and does not cause any warning messages. It is preferred for protecting credit card information.
* Wild Card SSL can be used on dedicated servers only.
There is a major difference in working of the Shared and Private SSL Certificates with HostGator Hosting Plans. The Shared SSL displays as “https://ip/~yourusername/ “or “https://secureservername/~username/ A “whereas Private SSL would be displayed as” https://www.yourdomain.com “in the address bar.
Setting up and Using Shared SSL
Shared SSL certificate are installed on all HostGator shared server machines. All HostGator shared servers have a shared SSL certificate installed on them. To access website using the shared certificate, user need to know the name of their servers and their cPanel user name.
To find and know the server name one can take help from the below mentioned procedure:
1. The server name will be located in the “Welcome Email” which HostGator sent the user while signing up for their account.
2. User can also find the server name in cPanel, in the left menu near the bottom.
3. Alternatively, user can run a trace route test on their domain and possibly see the server name.
To find and know the cPanel user name one can take help from the below mentioned procedure:
1. Shared: The user name for cPanel is located in the “Welcome Email” which was sent to user while signing up for their account.
2. Reseller: User name for cPanel is located in the “Welcome Email” which sent user when they signed up for their account. User’s client account user names can be found in WHM under List Accounts.
3. Dedicated: User must create a cPanel first, then the user name can be found in WHM under List Accounts.
The format for writing secure name is https://server.name.com/~cpaneluser/ and user will be successfully using the shared SSL. For an example, a shared SSL secure name can be https://gator123.hostgator.com/~bill/ whereas the example for the Reseller name can be : https://car.websitewelcome.com/~bill/
The user needs to remember that the shared SSL path requires the user name and the ending forward-slash, or it will not work. If users have any trouble getting the shared SSL to work, they can get in touch with the HostGator support team via phone or live chat and HostGator will be assist them.
Shared SSL for add-on domains and sub domains
First, the users need to know how to use shared SSL for the primary domain. Then, they need to learn how to set up and use shared SSL. To use shared SSL for an add-on or sub domain, the client should use his primary URL followed by the sub folder path.
EXAMPLE: Suppose he has an add-on domain named domain2.com and the folder associated with this domain is public_html/domain2.com. Suppose he has selected the shared SSL URL to be https://gator123.hostgator.com/~bill/
The correct format for the add-on domain will be https://gator123.hostgator.com/~bill/domain2.com /
Note: The public_html folder is never written into the websites address. Only the parts that come after /public_html/ are used.
Getting around the Shared SSL browser warning
If the client uses HostGator’s shared SSL, then the browser will show a warning page instead of site page. It is because the shared SSL is not specifically developed for the domain, therefore the security certificate does not match with the domain. When using HostGator’s shared SSL, the browser will give the warning. The best method to avoid the warning is to purchase private SSL. There are the following steps that explain how to bypass the warning for using the shared SSL in different browsers. For examples,
Firefox
To avoid the SSL Certificate warnings in Fire Fox Browser, one can follow the following steps:
1. Go to the warning message and click the “I Understand the Risks” link at the bottom.
2. Click the “Add Exception” button.
3. Click the “Get Certificate” button.
4. Click the “Confirm Security Exception” button.
Internet Explorer
Avoiding the SSL Certificate warnings in Internet Explorer Browser is even simpler and in fact a single step task. One can follow the following single step for getting rid of the warning message for shared SSL. For this it simply needs to go to the warning message and click “Continue to this website (not recommended).”
Complexities in avoiding the browser warning
The task of getting rid from the warning messages of SSL Certificate is in fact a task at the user end and not at the server end. Due to this, this can be expected from the users of the web applications and not the owners of the applications. This way, in some cases, this is in fact overlooking to the users abilities and their focus or expectations from the hosted application. To completely get rid of the warning message on the site, the only solution is to purchase a private SSL certificate. HostGator provides Shared SSL certificate online order for $50 per year or include them free with Business plan (Upgrade today)
Posting secure content, like images
If the page is already designed, then user does not have to do anything special. Their content should be loaded securely when they use the https address (URL). However, in case if their designer uses bad programming, then user may need to fix some of their HTML code. Media content (an image, movie, audio) needs to be referenced with a relative path. Example:
<img src=”images/banner.jpg”>
The most often cause of insecure content on their page is due to referencing media with an absolute path. Example:
<img src=”http://domain.com/images/banner.jpg”>
This absolute path uses http and not https. By using a relative path, user leaves part of the image location to be assumed. A browser will assume to use the URL of the web page. So, if user uses a relative path and the page is http:/ domain.com/page.html, then the image is assumed to be at http://domain.com/images/banner.jpg. Similarly, if he uses a relative path and the page is https://gator1.hostgator.com/ram/page.html, then the image is assumed to be at https://gator1.hostgator.com/~john23/images/banner.jpg.
While creating a relative link or path, user needs to be careful about adding an initial forward slash. Example:
<img src=”/images/banner.jpg”>
It tells the browser to assume the domain part of the URL only. If user’s page is https://gator1.hostgator.com/~john23/page.html, then the image is assumed to be at https://gator1.hostgator.com/images/banner.jpg which is incorrect and will result in the image not showing (404 error: Not Found).