SSL Certificate

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are security protocols that use cryptography to increase the privacy and security of data in Internet communications.

A digital certificate is a computer file that contains a set of information about the entity for which the certificate was issued. The entity can be a company, an individual, or a computer. It also contains the date of issuance, the validity period, and the public key that references the private key of the certificate.

The Digital Certificate, together with the SSL/TLS protocol, makes it possible to establish a secure channel between a web server (website, system, webmail, etc.) and a browser, ensuring that all data transmitted is protected and cannot be intercepted.

By using an SSL/TLS Certificate, you can also visually demonstrate that your Web site is trusted, authentic, and not a clone. When a valid SSL/TLS Certificate is enabled on a Web site, a padlock indicating a secure connection appears next to the URL that begins with HTTPS in the browser.

The SSL/TLS Certificate is essential for all types of Web sites and servers that need to protect data such as login information, registrations, and credit card numbers over the Internet. With digital crime on the rise, most people will not send their sensitive information through your Web site if it is not secure.

Google has launched a campaign to encourage all websites to use an SSL/TLS certificate. The Chrome browser will display the words "not secure" in the browser address bar for all websites that do not have a valid and active SSL/TLS certificate. However, if your site has SSL/TLS, it ranks higher in Google searches than sites without.

There are three main types of SSL Certificates, which differ in the vetting and authentication process required to obtain an SSL Certificate. The Certificate Authority (CA) verifies personal and organizational details before issuing a certificate. The time required to issue a Certificate may vary depending on the validation process.

• DV (Domain Validation): Domain validation is a primary level of the verification process in which the Certificate Authority verifies an applicant's right to use a domain name. No company information is verified and displayed in the certificate properties and secure site seal. Validation is done automatically via email or DNS and the certificate is issued within minutes.
• OV (Organization Validation): Organization validation is a verification process performed by a CA that not only verifies domain ownership, but also verifies business information. When a customer clicks on a site seal or certificate properties, additional and verified information is displayed. This increases customer confidence and assures them that the site is verified.
• EV (Extended Validation): The Certificate Authority verifies domain rights as well as thorough verification of business information. The entire validation process follows the standardized EV guidelines mentioned by the CA/Browser Forum. The validation process includes the following steps:
  • Verification of business identity with official government records.
  • Confirmation of the legal, physical, and operational identity of a business.
  • Domain rights verification.
  • Telephone verification and final verification call.

SSL/TLS Certificates provide the same level of encryption and security regardless of the level of validation. However, the more rigorous the validation process, the more confidence the certificate provides to your site visitors. OV and EV certificates display the company name in the certificate properties and security seal, proving that the site is not fake or cloned and belongs to a verified organization.

Depending on your system or web server, you may need a specific format of SSL/TLS certificate to complete your installation.

Once the issuance process is complete, the SSL/TLS Certificate is available in the most popular formats:

PEM

It is a file encrypted in Base64 format using ASCII characters. This is the most commonly used format for SSL/TLS certificates. Most web servers (e.g. Apache and Nginx) and Unix/Linux operating systems use this format.

The most common extensions for this format are .cer, .crt, .pem, or .key (for the private key).

P7B/PKCS#7

The PKCS#7 or P7B format contains the certificate and its chain (root and intermediate CA certificates), encrypted in Base64 ASCII format, in the same file with the .p7b extension. This format does not contain the private key of the certificate.

PFX/P12/PKCS#12

The PFX/P12/PKCS#12 format is a binary format that contains the private key, certificate, and its chain (root and intermediate CA certificates) in a single password-protected file. This is the format most commonly used by Windows servers.

Optionally, we offer the ability to generate the certificate in PFX/P12/PKCS#12 format through the customer portal. Simply generate the CSR request through our portal and the private key will also be generated and stored securely, encrypted and password protected.

Yes, you have full control of your digital certificate in the Customer Portal.

Once your payment has been confirmed, your certificate will be ready for quick and easy issuance.

You can submit your CSR to start the certificate issuance process or use our AutoCSR technology to securely generate the private key and CSR.

Once issued, you will be able to download your certificate in the format of your choice and reissue it free of charge during its period of validity.

All digital certificates have an expiration date property that is set once they are issued and cannot be changed. Even if a certificate is reissued, its expiration date remains the same.

Before your certificate expires, you must renew it by purchasing and generating a new certificate. Each time a new certificate is generated, a new installation is required.

If your current certificate was purchased from us, we will send you a renewal notice 10 days prior to the end of the subscription period.

Once the invoice is paid, the new certificate is made available for management via the Customer Portal.

Even if you purchased your digital certificate from another provider, you can renew it by simply purchasing a new SSL/TLS Certificate from us to replace the old one.

Remember that you must update the new certificate keys on your web server each time a new certificate is generated (new order, reissue, or renewal).

In this case, there is a problem with the certificate or its installation. The certificate may be self-signed (unreliable), expired, or issued to a different address than the one the browser is trying to access. There may also be a problem with the installation of the root and intermediate certificates.

Browsers display this message when one or more elements embedded in the page (images, CSS files, JavaScript components, etc.) are loaded via an insecure URL (http:// instead of https://) or with a URL that has an invalid certificate installed.

Here is some ways to solve the above problem:

• Change all URLs to https. Open the problematic page and search for "http://" and change all elements references to "https://".

  For example: <img src="https://www.yourdomain.com/image.gif" alt="example"/>

  Note: If the image is downloaded or copied from another site that is not secured with SSL, this solution will not work.

• Make the links relative. To eliminate the problem, you can choose to change all links to "/" instead of making them "https", for example: <img src="/image.gif" alt="example"/>

Warranty is an insurance policy for an end user against loss of money during the submission of a payment on an SSL secured website.

In the event that DigiCert improperly issues an SSL/TLS Certificate for a website and an end user (website visitor) has a financial loss as a result of a fraudulent transaction on that website, believing it to be an authentic website, the end user may recover the money lost in the transaction from DigiCert up to the amount of the certificate's warranty.

This guarantee provides greater trust for websites with an active DigiCert SSL/TLS Certificate.

More information on warranty provided by DigiCert can be found at DigiCert Relying Party Agreement and Limited Warranty.