Setting Up SSL

Started by jina, Jun 20, 2022, 02:19 AM

Previous topic - Next topic

jinaTopic starter

I have done some research on SSL and have a few questions. Would I need a dedicated IP for the SSL? Would I be able to use a secured and unsecured connection with the same domain/IP (http vs https)?

Thanks in advance!


You can get valid FREE SSL certs here, and they work in all major browsers.


Dedicated Ip will cost you more than 24$+/- a year, I think you should have atleast $50 to setup your own ssl in your site. Free ssl can give you only 30 to 90 days extensions.


If the HTTPS protocol is to be used to work with the web site, after installing the certificate, you need to configure a secure connection for all elements and pages of the site.

First of all, the web site is redirected to the secure HTTPS protocol. Redirection from the HTTP protocol to the HTTPS protocol is implemented by adding to the beginning of the file .htaccess of the following directives:

RewriteEngine on
SetEnvIf X-Forwarded-Proto https SERVER_PORT=443
SetEnvIf X-Forwarded-Proto https HTTPS=on
RewriteCond %{HTTP:HTTPS} !=on [NC]
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

Also, all links on the site are checked for explicit use of the HTTP protocol. If there are elements that open via an insecure protocol, the connection will be considered untrusted, and information about that will be displayed in the address bar.

If there are elements available only via the HTTP protocol, the links to them need to be changed to relative (for instance, instead of in the page code, the link should look like /content/pic.jpg ), or explicitly specify the use of the HTTPS protocol (in that case, the link will look like ").

It is also necessary to change the links for elements loaded from external resources. For instance, if the web site uses a script available at .js, that link should be changed to // .js or .

The web site where the element is located must also have a valid SSL certificate.

To include the HSTS mechanism in the file .htaccess in the root of the site you need to add a directive:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Adding a site to the list must be done manually after adding the directive.

Google considers the use of HTTPS on the web  site as a ranking factor. For the correct indexing of the site over HTTPS, Google recommends following the following rules:

Redirect users and search engines to an HTTPS page or a resource with 301 redirection on the server side for HTTP addresses.

Use relative URLs for resources that are on the same protected domain.
For instance, to go to a page on your site , use a href="/about/ourCompany.php " preferable to a href=" ". This ensures that your links and resources will always use HTTPS.
that also reduces the likelihood of errors in the local development of the web site, since images, pages and other resources are loaded from the local development environment, and not from the production environment.

Use protocol-similar URLs for all other domains (for instance// ), or update your web  site's links to go directly to the HTTPS resource.