Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site running only with http. I have decided I want to go full https, but I have no idea how to do this.

  1. Do I have to buy that certificate somewhere? Where, how much does it cost?

  2. Does it involve changes in my actual code? Forms, ajax, etc..

  3. Do I have to change something in my server config? What, how, where?

I'm running PHP, I have ftp access to files on server, I can use Parallels environment in browser to change some things on servers...

share|improve this question

closed as off-topic by Mark, Xander, Adi, TildalWave, AJ Henderson Aug 11 '14 at 14:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Adi, AJ Henderson
If this question can be reworded to fit the rules in the help center, please edit the question.

What is your server OS? Is it on shared hosting? – Kasun Aug 9 '14 at 12:29
Voting to reopen. I agree detailed step-by-step instructions on how to get a certificate from a specific provider or step-by-step configuration changes necessary for a bunch of specific webservers would probably be out of scope, but a general how to set up an HTTPS seems very in-scope here. It's a problem people actually face, many people do it incorrectly, and while say superuser or another site may get an answer that gets you up and running with HTTPS, it may not be configured securely (e.g., allow weak ciphers, leave in HTTP links/embedded resources, not test your setup). – dr jimbob Aug 11 '14 at 23:43
@drjimbob I completely agree with your argument, but this question is far too server/protocol basic. We also don't have enough information to provide the details that would be helpful. If this question could be re-written, then I would vote to re-open. – schroeder Aug 12 '14 at 14:36
up vote 8 down vote accepted
  1. You can get a free class-1 certificate from (I have no affiliation with them other than using them for my free SSL certificates). It's not the most user friendly experience, but it gets the job done for free -- note the free certificate will only last a year (and doesn't offer features like wildcard certificates for free). There are plenty of other sites that offer more features at other price points.

  2. Not really, with a few exceptions. If you ever hard code a link as http:// in your site you need to change it to https:// or just have it as a relative link or use // (which will be equivalent to if you are on an http page, and from an HTTPS page. This also applies to things you may forget, like embedded content - images or CSS or JS files loaded off of a CDN. You also probably want session cookies to have the secure flag enabled.

  3. Yes. Will depend on your webserver. Will have to enable SSL running on port 443, select the ciphers you want to allow, point your webserver to your CA-signed certificate as well as the associated private SSL key. You may need to add the intermediate SSL certificates to your chained SSL certificate. There are plenty of guides and tutorials out there; e.g., here's one for nginx. You will want to find a good selection of ciphers and SSL/TLS to allow. Mozilla maintains a list of recommended ciphers here, I suggest you use it. A good way to test your configuration is this SSL testing tool. You also may want to turn on HSTS (if your site will only be served over HTTPS in the future; this prevents it from being served via HTTP in a MITM attack). You also should set it up that when tries to go to that it automatically redirects to as appropriate (and should choose whether this is a permanent redirect or temporary one).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.