Quick Start Guide: Migrating To Always-On SSL - DigiCert

QUICK START GUIDE:MIGRATING TO ALWAYS-ON SSLNow that Google has added a rank boost for Always-On SSL (AOSSL), it makessense to enable HTTPS across your entire Website. But where do you start?DigiCert created this guide to give you an in-depth look on how AOSSL can helpyou and to get you started with implementing AOSSL on your own Website.GET YOUR COMPANY ON TOP WITH AOSSLWe know you’re always looking for new ways tomake your company stick out—whether that’s insearch engine rankings or in your customer’s minds.And with Google’s recent announcement that HTTPSeverywhere is a factor in their ranking algorithm, SSLcan be part of your solution.users immediately recognize them to mean security.By ranking higher in Google, you will be drivingmore traffic; and with the added security benefits ofSSL your new users will feel confident on your site,positively affecting conversion rates.Unlike many of the ranking factors in Google’s searchalgorithm that are vague or difficult to measure,having HTTPS everywhere is a guaranteed way to getyour site ranked above your competitors. And thoughit’s starting out as a lightweight signal, Google haspromised that the weight of SSL as a ranking factorwill increase once webmasters have time to migratetheir sites.The HTTPS everywhere ranking signal is standaloneand is independent from any of Google’s other rankingsignals or algorithms. As soon as a new HTTPS pageis indexed by Google, you get a boost in your searchranking just because of the HTTPS URL. While thisdoesn’t mean that your page will automatically jumpup a few ranks in search results, it does mean that youwill get a boost in your overall rank.Having SSL site-wide also helps your marketing anduser engagement. SSL Certificates are the top methodfor online encryption and authentication today andAs is the case with every other SEO ranking factor,the first wave of Websites who follow Google’srecommendation and migrate to HTTPS everywhereHOW AOSSL BENEFITS YOU

TOPIC: MIGRATING TO ALWAYS-ON SSLshould receive the best long-term results. Byimplementing AOSSL now, your pages will rank higherthan your competitors who haven’t implemented SSLyet. By incorporating SSL into your SEO strategy, youprepare your company for the future of SEO and showyour visitors that you take their data security seriously.Because users trust SSL Certificates, they are provento increase conversion rates, improve engagementmetrics, and elevate brand reputation. According to astudy by Tech-Ed, 100% of participants would preferdoing business with a company that has an EV SSLCertificate.Currently, SSL Certificates are mainly used on pagesthat handle sensitive data, like on login or checkoutpages. This causes users to bounce back and forthbetween HTTP and HTTPS sessions. By having SSLon all of your pages, users’ sessions are secured theentire time they are on your site—protecting any andall data that they transfer.MIGRATING TO AOSSLMoving your site to HTTPS involves more thanjust going out and purchasing an SSL Certificate.DigiCert recommends reading the followingsections thoroughly and working closely with your ITadministration team to make the transition.1. Figure Out What Certificates You Already HaveIf your site deals with sensitive user information, youmay already have an SSL Certificate on a portion ofyour Website. Before you go buy an SSL Certificate,it’s best to know what you already have. In mostorganizations, the IT administrators handle purchasingand installing the SSL Certificates. Work with your ITteam to find out what certificate(s) you already have,if any, and what pages of your Website they secure.We recommend using DigiCert’s Certificate Inspectortool to find all of the certificate resources in yourenvironment. This tool will scan your domain or arange of IPs to find certificates. You can also useCertificate Inspector to scan your internal network forSSL Certificates.2. Decide What Kind of Certificate You NeedOnce you understand your current certificatelandscape, you will better know what kind ofcertificate you need. Even if you already have an SSLCertificate, you may need to purchase an additionalcertificate to secure your entire site.For example, if you handle sensitive data you mayalready have an SSL Certificate that secures the loginor checkout page on your site. However, this singlename SSL Certificate may not be able to secure therest of your company’s resources if you have multiplesubdomains or even multiple domains. You may wantto switch to a UC (SAN) or Wildcard certificate if youneed to secure multiple subdomains or domains.You may also want to transition to an EV SSL Certificatefor the added user trust and visual cues like the greenaddress bar.DigiCert has many types of SSL Certificates designedto meet a variety of needs. For a more detailed

description of each certificate type and moreinformation on what type of SSL Certificate is right foryour situation, read this article.3. Create a CSROnce you figure out what kind of certificate you need,you must create a CSR. A CSR is a file that you (or yourIT admin) generate on the server where you will installthe certificate. Work with your IT admin to determinewhat server this is and to generate the CSR file.You can find step by step instructions on creating aCSR for a variety of platforms in the support section ofDigiCert’s Website. Or, if you have a Windows server,you can download the DigiCert Certificate Utility forWindows to automatically generate and upload yourCSR.5. Install the CertificateOnce you complete the validation process and receiveyour SSL Certificate, you or your IT administratorcan install it on your server. You can find step bystep instructions for installing an SSL Certificateon a variety of platforms in the support section ofDigiCert’s Website. Or, if you have a Windows server,you can download the DigiCert Certificate Utility forWindows to automatically install your certificate.After your certificate is installed, we recommend thatyou check that everything is working correctly usingour free Always-On SSL Site Checker.If you have any questions, please contact our supportteam at 1-801-701-9600 or email support@digicert.com.4. Purchase the Certificate6. Migrate Your Site to HTTPSNow that you know what kind of certificate youneed and you have a CSR, you are ready to buy yourcertificate. There are a few factors you should takeinto account when deciding who to purchase yourcertificate from:Once your certificate is installed, you must migrateyour site to HTTPS. By following some simple steps,you can make your transition to HTTPS easier and makesure you are getting the most out of the SEO benefit.We recommend that you provide the following tips toyour IT administrator. Issuance Time: Some CAs take days or even weeksto issue a certificate. DigiCert has the fastestissuance times out of any CA, we can even issuean EV certificate in a matter of hours!User Trust: Though all SSL Certificates have thesame encryption, the level of trust a certificateprovides depends on the issuer. DigiCert hasprovided SSL Certificates for over a decade.Customer Support: While migrating to Always-OnSSL, you may have questions or run into a problemthat you can’t solve. At DigiCert, our expertsupport team is standing by 24/7 to help you.Powerful Tools: Certificate management tools cansave you and your IT team a lot of time. DigiCert’sinnovative dev team has created tools to help withevery step of the cert management lifecycle.Making the Move Break up the transition to make it moremanageable.Consider breaking up your transition into phasesto make it more manageable. However, rememberthat the ranking boost only applies to pages thathave HTTPS enabled so move pages with yourtarget keywords first. Track your site migration in Google WebmasterTools.List the HTTP and HTTPS versions of your siteseparately in Webmaster Tools. Because all ofyour site traffic will move to the new HTTPSversion of your site, you should track both sites inany analytics software and in Webmaster Tools tomonitor site traffic.

TOPIC: MIGRATING TO ALWAYS-ON SSLConfiguring Your Server Enforce 256-bit minimum session keys. Test your Website for unsecured content.Manual testing can help you find pages wherecontent is being accessed over HTTP. Duringtesting, disable access via Port 80 (HTTP). WhilePort 80 is disabled, all content that was goingthrough Port 80 will be broken and you can quicklyfind and fix it. Once elements that access Port80 have been eliminated, re-open Port 80 andredirect it to Port 443 (HTTPS). Use a server that supports HTTP StrictTransport Security (HSTS) and enable it.HSTS tells browsers to always load pages usingHTTPS even when the user enters HTTP in theaddress bar or another site links to the HTTPversion of a page. It also tells Google to serveHTTPS URLs in the search results. Add a server-side 301 redirect.Set up a server-side 301 redirect to direct trafficfrom port 80 (HTTP) to port 443 (HTTPS). Googleconsiders the HTTP and HTTPS versions of yourWebsite to be different sites. Because of this, ifyou do not redirect traffic Google may see yoursites as having duplicate content and penalize you.Make Search Engines See Your Site as Secure Use relative URLs for resources that are on thesame secure domain.There are three types of URLs that you can use forresources on your domain:Absolute HTTP URL: a href “http://www.domain.com/example/about.html” Absolute HTTPS URL: a href “https://www.domain.com/example/about.html” Relative URL: a href “/example/about.html” While relative URLs are recommended, if youneed to use absolute URLs you should make sureyou are including HTTPS instead of HTTP. This willensure that the user clicking the link will reach theHTTPS version of the resulting page or resource.This will also ensure that when Google is scanningyour Website they will see HTTPS URLs. Use protocol-relative URLs for all otherdomains.Use protocol-relative URLs or absolute HTTPSURLs for all other domains. Protocol-relative URLsfor external sites can be formatted as follows: ahref ”//domain.com/example/about.html” .Don’t block your HTTPS site from beingcrawled using robots.txt.Allow your pages to be indexed by search engineswhere possible and avoid the noindex robotsmeta tag.Move all resources to HTTPS.To get the ranking benefit, your whole site(including all URLs, files, images, dynamic HTML,JavaScript, CSS, assets, and anything with a hrefattribute) must go through HTTPS. This meansgoing through your entire Website and cleaningup the links, as well as making sure all of ourresources are accessible through HTTPS to avoidmixed content.