Https how to??

[hargi]

Hi fokes,

Still in the design stage of the web app that im building, a online repository, for documents that send out to certain people, basically a php/ mysql solution.

The only problem is I have found out that it needs to store some confidential documents on there.
So it needs to be HTTPs: and may requiere a security cert. As I know nothing about programmig HTTPS conections how difficult would this be to do. is it something i should be looking at doing or should I say anything confedential should not be put on there

 

[Pho]

You need to get the certificate installed on your web server which isn't too difficult, but apart from that you shouldn't need to change anything on your site bar making sure people are accessing it via https.

 

[Vtec9k]

Usually you only need to configure the web server and the webapp will not care that it's using https rather than http.

You can buy a cert for pretty cheap but some of the "extented validation" style ones are a couple of hundred. The exact steps depend on what web server your using, basically you generate a CSR then give the CSR to whoever you buy your certificate from and they give you back the certificate which you install. It's usually pretty quick but you may need to verify domain ownership or company details.

Of course SSL only encrypts the actual communication between client PC and web server. It doesn't actually protect any files that are sitting on a servers disk so it depends how confidential they are.

 

[Koalaboy]

Also, some of the 'cheap' certificates aren't in the root store of the main browsers, so the user will get a security warning each time unless they import the public certificate.

For example: http://wiki.cacert.org/BrowserClients

If you're willing to have them go down this path, you could just create a self-signed certificate (free). It depends on how 'reliable' you need to be.