2

I've got a Magento installation on a server. I have been contemplating getting a certificate for my site. However, since all of the credit card and other payment options are being processed offline, do I really need it? After all I can still connect via an encrypted channel to the remote Magento installation on the server (using HTTPS). The only problem I see is that such encryption connection is still subject to impersonation from an attacker mimicking the remote host, so when I access the admin panel of course such an attacker could steal my password. However, I doubt this is a likely scenario, especially since there are also many other e-commerce sites out there, and most importantly, since customers do not need to access the admin panel and don't need a secure channel for browsing products and adding them to their shopping cart but only need such a channel at checkout time, and such channel is provided by the gateway service provider, I don't need to install one myself.

Would like to hear opinions on this matter. I've read that SSL certificates make the client more secure, but then again they will not be seeing the lock icon in the URL if they are just connecting with plain vanilla HTTP.

Thanks.

  • 2
    SSL Certs can be purchased from GoDaddy for $69. For the increase in conversion rate, security, and perception from your customers (who are getting more and more savvy), it's a very cheap investment. – cale_b Oct 23 '13 at 18:00
  • Are you saying my customer is just going to stick that https:// in there just to see if a lock shows up? – John Sonderson Oct 23 '13 at 20:03
  • 1
    No, but they are being trained more and more to look for indications of a secure site. – cale_b Oct 23 '13 at 20:27
  • No lock, no sale in most cases. If your site doesn't switch to secure service when handling sensitive information in this day and age (we're not in the '90s) expect a few death threat emails and the finger. As someone who had a certificate fail, yes, they do pay attention, no it isn't good for your reputation, especially if it gets out on various forums dealing with the product you sell. – Fiasco Labs Oct 24 '13 at 1:41
  • StartSSL is also worth a look startssl.com/?app=40 because you there buy identification for one year, meaning you can create as many certificates as you want and this for only 120$ (for companies, 60$ in your name but that looks strange on a shop) – Josef Feb 6 '14 at 12:00
4

The only reason I can see why you really wouldn't want to have an SSL installed is if this will create a poor environment for your customers that you do not have the time or resources to fix.

For example, you may have various assets on your side hard-coded to load over HTTP (scripts, images, stylesheets, etc). Once you start loading the site over HTTPS, you will probably get a bunch of warnings in the browser's console and there will probably be a number of things on the site that will no longer work properly.

If this is the case, you have to ask yourself if it is going to be worth it in the long-run to just fix these things (might take an hour, or in some cases of highly-customized development, a few days) and install the SSL, or instead just leave them alone and deal with potential loss of sales because of a customer's weariness.

For the majority of e-commerce operators, this is a terrible decision. The proper decision is to fix your site to work properly and use SSL. I can see, though, some edge cases where it is more feasible to just leave it alone for now and note down that this needs fixing in the future. With the holiday season coming up, you may want to leave it alone for now and fix it after the busy season, for example.

That all said, @philwinkle is giving you sound advice and ignoring your SSL is just going to make things more difficult in the long run.

  • 5
    If you don't have time or resources to worry about SSL, don't operate an online store (my $0.02). If you coded images and javascript or have 3rd party integrations that rely on plain HTTP those should be addressed anyhow. Outside of that, I hear your reasoning and appreciate another voice of input. Always welcome my friend. – philwinkle Oct 23 '13 at 17:52
  • Thanks. I think you deserve the plus one, because you made me realize something. The entity which really needs to be certain they are communicating with whom they think they are is the payment gateway or payment service provider. Of course if someone masquerades as you they can submit stolen credit card information to the payment gateway on your behalf, and I don't want that. Plus, the PSP or PG won't certainly let them happen, so I bet you they enforce the certificates on their clients. – John Sonderson Oct 23 '13 at 20:15
  • Given the certificate might be used in this way, it means that they might never see it. – John Sonderson Oct 23 '13 at 20:16
  • Actually, they would see it since as pointed out user accounts are sensitive data as well. How silly of me not to think of that. – John Sonderson Oct 23 '13 at 20:17
  • 2
    For what it's worth I would not so much as submit a contact form without seeing HTTPS. Cheers. – philwinkle Oct 23 '13 at 21:20
9

This question is not a black-and-white Q&A-style question. It will have no de-facto answer and will likely be closed. However, I have extremely strong opinions on the matter, which I have detailed below. Hopefully I've understood your question.

Here are a few concerns of mine:

  • You underestimate the consumer. Today online shoppers are educated. They're looking for safety and security online. You're willing to forego a customer's purchase because they should be confident in your offline business practices and you don't want to spend $99.
  • The opportunity cost of an SSL certificate should far outweigh the loss of a potential customer with a high lifetime value.
  • Your competition probably has SSL certificates. You should, too.
  • You have decided to process payment offline. Do you even need a shopping cart? How are you storing card data? Is this entirely PO-based? Is this even a public-facing system? These are all valid areas of concern.
  • Security of your customer's information extends beyond just the credit card #. Your goal should be to protect more than just the exchange of payment information - a person's address, phone number, or PO account information is also valuable.

I hope the above gives you a real business sense of why you should have SSL. I encourage low-traffic stores to force the entire store to SSL. Seeing the green bar or lock at all times is encouraging to customers - something that I have split -test time and time again.

In addition, you can force SSL on cart/checkout and on certain routes and even CMS pages. You don't need to run your entire store in SSL mode. Search around on this site for some guides and best-practice regarding the setup of SSL on your Magento installation.

  • Yes, I need a shopping cart, because magento stores orders in the database, which can then be fulfilled from the orders menu in the backend, which is where I will see what items I need to send out. – John Sonderson Oct 23 '13 at 20:07
  • Shopping cart data is sent out over the network to the payment gateway, which stores credit card information, and then returns to me with either a yes, transaction successful, or a no, transaction failed. I know many large businesses which deem the cost of PCI too high and do not want the security burden, so offer a checkout button which brings the customer to the payment gateway where they may fulfill their order. You seem to have some misconceptions about SSL certificates. They do not stop an employee from hacking the system. They do not track viruses. – John Sonderson Oct 23 '13 at 20:09
  • They only ensure the client is communicating with the party the client thinks they are communicating with. Nothing more. – John Sonderson Oct 23 '13 at 20:10
  • Sorry for the rushed conclusion. See my comments below. – John Sonderson Oct 23 '13 at 20:15
  • 2
    I'm not entirely sure where you're coming from here - but everything you say makes sense. What I'm looking for in HTTPS is beyond just trust or identity/verification of who I'm communicating with -- I would like to know that my data being transmitted over the internet is being secured by TLS (or better) encryption that can only be deciphered by a system that has the private key. That system is your website and your website alone. Period. I would not so much as submit a contact form without seeing the HTTPS. – philwinkle Oct 23 '13 at 21:23
1

Today you can get an SSL/TSL certificate for free at https://letsencrypt.org/. Installing certbot will take care of the renewal.

Today, SSL/TSL is standard. Websites without will be considered old and out of date. It is reported as a ranking factor in Google which could impact your sales.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.