How to Implement SSL, HTTPS and HSTS Support?

HOW TO IMPLEMENT SSL, HTTPS AND HSTS SUPPORT? ORIGINAL BLOG ON BTHRUST.COM/BLOG.PHP

Step 1: Buy SSL Certificate

Documentation • Prepare by getting your server set up and getting your WHOIS record updated (it needs to show the correct company name and address), etc.

•

Registration

Download the Files

Generate the CSR on the server.

• After you create a CSR (certificate signing request) and purchase a certificate, our Validation team validates and processes your certificate request.

Once validated, your SSL Certificate will be sent to you via email.

• Submit the CSR and other info to the Certificate Authority.

• Have your domain and company validated.

Step 2: Install the Issued Certificate 1. How SSL Certificate Looks • An SSL Certificate is a text file with encrypted data that you install on your server so that you can secure/encrypt sensitive communications between your site and your users.

2. Find httpd.conf

3. Edit httpd.conf

• Apache's main configuration file is typically named httpd.conf or apache2.conf.

Possible locations for this file include /etc/httpd/ or /etc/apache2/ for a comprehensive listing of default installation layouts for Apache HTTPD on various

• The SSL certificate configuration is located in a block in a different configuration file.

The configuration files should be under a directory like /etc/httpd/vhosts.d /, /etc/httpd/sites/, or in a file called httpd-ssl.conf.

Configure the block for the SSL-enabled site If your site needs to be open through both secure (https) and non-secure (http) connections, you need a virtual host for each type of connection in your htaccess file. Make a copy of the existing non-secure virtual host and configure second one for SSL.

It looks like this: DocumentRoot /var/www/html2 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/DigiCertCA.crt

4. Change the File Names to MatchYour Certificate Files.

SSLCertificateFile

SSLCertificateKeyFile

SSLCertificateChainFile

• SSLCertificateFile is your DigiCert certificate file (e.g., your_domain_name .crt).

• SSLCertificateKeyFil e is the .key file generated when you created the CSR (e.g., your_private.key).

• SSLCertificateChain File is the DigiCert intermediate certificate file (e.g., DigiCertCA.crt).

5. Test installation

Test Server

Test installation

• Test your Apache configuration file before restarting and then restart

• Try to open website with https://, if it does open with https that means your SSL certificate is installed.

Test Website • Open your website with https://, not with http://

Step 3: 301 Redirects from HTTP to HTTPS

Implementing 301 redirects is one of the most significant steps in a HTTP to HTTPS migration. 301 permanent redirect passes between 90-99% of link juice (ranking power) to the redirected page. It is an official SEO ranking factor for Google Search.

Use below Code to Redirect entire domain from HTTP to HTTPS in Apache Server RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For WordPress Use plugin – Install and activate “Really Simple SSL” plugin. Then go to SSL tab and Acvtivate SSL Redirect.

Step4: Implement HSTS Support Edit your .htaccess file and use the code below to set the header

Header always set Strict-Transport-Security: max-age=300; includeSubDomains; preload

READ FULL BLOG ABOUT SSL AND HSTS SUPPORT HERE.