Protecting our user, our apps or our websites is one of the most important tasks for us as web software developers. In our effort to secure the applications we employ many techniques. Using SSL certificates and delivering the application or website through https is one of the most basic things we can do. Yet, not so many people are doing it, not even now when besides the added security one could benefit from improved rankings in the Google search engine as Google considers this a ranking factor in its search results.
So why there are so many http sites out there? Why people expose their users and their data to unsecure access ? There are a variety of reasons. Some people are just lazy, others consider the setup of the certificates too complicated and of course there is also a cost involved in buying the digital certificate. Well, guess what ? 2 out of these 3 reasons went away when AWS launched the Amazon Certificate Manager. Not only that they’re offering SSL certificates for free but the deployment of the certificate can be done in a few clicks. There is no more CSR requests to be made, no more hassle in configuring the server. You just request a certificate and deploy it on your Elastic Load Balancer or your Cloudfront Distribution, all this without any additional cost. To do this Amazon have setup their own Certificate Authority called Amazon Trust Services LLC (https://www.amazontrust.com) and they’re using this to issue the certificates.
That was the good news, the bad news is for people who use other hosting or cloud providers. You can only use these free certificates on the AWS infrastructure and even there you can deploy a free SSL certificate on an Elastic Load Balancer or a Cloudfront Distribution (as of the writing of this article).
I’ve already deployed SSL certificates on all my websites, you can see that this very blog is using an SSL certificate and can be accessed only via https.
So if you’re on AWS infrastructure then you have no excuse not to use an SSL certificate and a secure connection to your app/website.
Laszlo Bodor
