SSL

SSL (Secure Sockets Layer) Certificates are small data files that digitally bind a cryptographic key to an organization’s details. When installed on a web server, they activate the padlock and the HTTPS protocol to allow secure connections from a web server to a browser. SSL Certificates secure data transfer, credit card transactions, logins and more. They authenticate the identity of the company and provide customers with the confidence to transact with it.

We use SSL certificates to secure our clients’ web apps and protect their and their customers’ sensitive information during various transactions. These certificates ensure that data transferred between users and the site is secure and cannot be intercepted.

Enforcing an SSL Connection

To ensure our clients’ applications are always secure, we can use the config.force_ssl option in the production environment’s configuration file (config/environments/production.rb) to enforce all requests to be under HTTPS protocol. This forces all access to the application to take place over SSL. It also makes cookies secure and enables HSTS (HTTP Strict Transport Security), which tells browsers to remember that this website should always be accessed over HTTPS.

When purchasing and installing SSL certificates, our engineers will often use the openssl command line tool to generate CSR (Certificate Signing Request) and private keys. This process usually involves interaction with the server hosting the application and the Certificate Authority (CA) providing the SSL certificate.

SSL Certificate Expiration Dates

While we aren’t always responsible for SSL certificate renewals, we often need to play a role in updating them. To assist in this, we’ve created a document in Confluence that lists all of the apps and domains we’re working on, along with copies of their current SSL certificates and their expiration dates.

You can view that SSL Certificate Expiration Date list here.