Five mistakes teams make with HTTPS and SSL
Every audit we run turns up some version of this. These are the ones we run into repeatedly when we audit HTTPS and SSL.
The cheapest security work is the boring kind done on a schedule. Assume whoever inherits this will have half your context and none of your patience.
Warning signs
- Treating it as a launch task rather than an ongoing one
- Assuming someone else already owns it
- Browsers now actively warn on unencrypted pages
- Certificates can and should renew automatically
- Never checking whether the fix actually worked
Mixed content quietly breaks the padlock. There is a version of this that is over-engineered, and it is worth avoiding. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.
Making it stick
The short version
The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about HTTPS and SSL before you move on:
- Someone can say what the current setup is without going to look
- Browsers now actively warn on unencrypted pages — and you know whether that is true here
- There is a way to tell whether the last change to this helped
Most of the value here comes from doing the first two things, not all of them.