1

At my work, we've been using Network Solution eCommerce for many years now, and they have been working very well for us. However, as the years go on, their services become more and more outdated. As a web developer in 2014, working with a strictly table-based layout is frustrating. The constant need to us JavaScript to modify the layout, as well as using multiple CSS hacks has driven me to look for a new solution. My boss wouldn't mind moving away from the platform either.

I have been eyeing up Shopify for some time now. It's a designers dream in terms of eCommerce, being able to design it from the ground up using HTML 5, proper CSS, and eliminating the need for all the JavaScript and CSS hacks. However, they use a shared SSL certificate instead of a dedicated SSL. On our current site with Network Solutions, when a user goes to our checkout, they go to https://www.ourwebsite.com/checkout.aspx. With Shopify, they go to https://checkout.shopify.com/carts/randomhashidentifyingyourcart.

This doesn't really appeal to my boss. He believes that as a medium-sized, reputable business, if a customer noticed that change in the URL, it would either a) deter them from continuing, or b) make us look smaller/less reputable than having our own SSL. I understand his point, but I'm not sure that many users will care. He uses Shopify for one of his side businesses already, so he is familiar with the platform and loves it, but just isn't sure the SSL issue is fitting for our business.

I guess I'm looking for some other peoples opinions on this issue. Sometimes I can convince them to make changes even if they don't like to, so I'd like to have some opinions and info from other people to back me up a bit. We have many more pros for making the switch than cons, with the cons only being the SSL.

4

The "shared SSL certificate" actually translates in a visible form an underlying structural property, i.e. that Shopify is a shared eCommerce platform. When you use Shopify, your store is running on their systems. If that makes you look like a cheap business, then well, I guess you are a cheap business after all. The shared SSL certificate is just a technical point in which your cheapness is made apparent.

Technically, having your own name for SSL connection can be at odds with some constraints on Shopify's side. It is due to the following:

  • In HTTPS, the SSL occurs first; the HTTP request (which includes the target server name, as seen from the client) will be sent only when the handshake is completed.
  • During the handshake, the server shows its certificate to the client.
  • The client expects the intended server name (as it appears in the URL) to be part of the identities contained in the server certificate.

So a server who is hosting several (many) sites with distinct names on the same IP address must somehow guess the intended server name, so as to use the right certificate. Such guessing may use the Server Name Indication extension, if the client sends it -- but IE on Windows XP does not send any SNI. The consequence is that if Shopify wanted to support shop-specific server names for SSL, then they would have to do one of the two following things:

  • Allocate a new IP address for each shop (given the current relative shortage of IP addresses, this can become expensive).
  • Forfeit XP+IE customers (a non-trivial business decision).

In any case, Shopify is God: they have full control over your online store. The shared SSL certificate corresponds to that fact; it does not add any additional security issue.

(Said otherwise, you get what you pay for. If you want your SSL with your own name, then you have to own your own IP address, preferably your own server as well.)


Personally, as an occasional online customer, I feel rather safer when I see that the payment system is handled by a bank or some specialized platform like Shopify. That's because I know that 99.99% of frauds and other similar adverse events don't occur during the transit of the credit card number over SSL, but afterwards, on the server side. I really prefer it when professionals are at the command. Attackers don't bother trying to run fake SSL server to catch a dozen credit card numbers; they prefer hacking into amateurish servers to purloin thousands of credit card numbers where they were (poorly) stored.

However, I am known not to think like an average customer. That's the fate of being an information security professional, I believe.

  • Good points. Network Solutions is a hosted platform, but we do get a dedicated IP address that allows us to have the dedicated SSL as well. Shopify does offer a service, Shopify+, which is meant to be for enterprise, and does offer a dedicated IP and SSL, but it's way out of our budget. I do also agree on your point of seeing Shopify in the URL as being beneficial. As a web developer, I could whip up a simple form that grabs your CC info and saves it in a database in minutes, and go and get one of any various $5-$10 SSL certificates and make it look legit. Never thought about that. – Devin Jun 19 '14 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.