Is .app domain no needs to have a sepearte SSL certificate - ssl

I am a newbie in web development, i heard about .app domains from google with builtin https security.
IS .app domain no needs to have a sepearate ssl certificate since it is builtin and all request are https by default.
https://techcrunch.com/2018/05/01/google-is-launching-app-domains-the-first-tlds-secured-with-built-in-https/

As you can read from the link:
Google is requiring HTTPS for all. app websites
So you buy domain but you should take care for hosting and for certificate. If Google offer bundle with domain, hosting and certificate this do not change the things. You need certificate independently from the provider of the service.

Related

is it possible to generate an SSL certificate for an internal site?

On Windows10 I have an internal website on iis, which I access through a url https://localhost:44300.
Currently I have the security messages come up when I first load the url and I have the broken padlock.
Unfortunately the network I'm on blocks security certificate warnings and I can't get to my site.
Is it possible to buy an SSL certificate for an internal site?
At the moment I'm using mkcert to be my own CA, but I'm told this is not suitable for a production site.
Thanks Ian.

Change Http to Https for c# web application

I have a quick question on opting the SSL Certificate for the Web Application. In the Web Application, am using Kestrel as WebServer and application is not configured in IIS.
For Customers, I install the Application as a Service in Server Machine and its used by the employees only in intranet. Now the address of my application is http://machineName:port but I would like to have https://machineName:port.
Question 1) Is this possible for the Intranet sites?
Question 2) Will SSL be really needed in this case?
Qeustion 3) SSL works, only if I configure Web Application with IIS?
Yes it is possible. As long as the certificate is trusted by the clients. You can create a self signed certificate and have client machines add it to trusted root certificate authorities in windows. Or if the intranet is using a windows domain, you can have a Certificate Authority trusted by domain computers issue the certificate.
SSL is always better even in intranet and localhost scenarios. It ensures site identity, encrypts traffic, etc. Whether it is needed depends on the site. Some browser functionality such as using the camera/mic won't work unless the website is using SSL.
Kestrel allows using SSL. Checkout docs here.

How to Enable SSL Certificate for my website?

I am new here.
My website is LifelineFoundations and I haven't enabled SSL for this website.
Would someone please help me out and tell me the information regarding how to enable SSL certificate for my website, and in case if I won't enable it what would be the penalties I have to face?
An SSL certificate works to create an encrypted connection between your visitor’s browser and the server.
To enable SSL Certificate for your Website follow below steps :
Host with a dedicated IP address
Buy a certificate
Activate the certificate
Install the certificate
Update your site to use HTTPS
If you have hosted you site with some Domain Providers like GoDaddy, they provide a detailed list of instructions for installing SSL.
However if you have your own dedicated host with a web server installed, you need to generate CSR depending upon the operating system and have to make entry in the web servers. The instructions for the various web servers and operating system is mentioned here by DigiCert.
Regarding the impact if we don't go for SSL Certificate :
Mostly all the web browsers mark your website as not secure which creates a bad impact when a visitor is browsing your website
All the password and credentials would not be secure if entered through a non HTTPS Channel
All the form data and sensitive information would be critical and vulnerable if you are not using TLS( connection used when SSL certificate is installed ).

Securing my Azure Web App with HTTPS

Say, for example, I have an Azure web app named MyApp and is hosted on Azure as MyApp.azurewebsites.net. It's my understanding that there is nothing I need to do to secure the URL with SSL, as it's done, by default, with a single certificate. So I can already have my users access the app via https://MyApp.azurewebsites.net, and it will be secure right out of the box.
However, say I have another URL named www.MyApp.com that I want to point (redirect) to https://MyApp.azurewebsite.net. Do I have to secure www.MyApp.com with a certificate?
Do I have to secure www.MyApp.com with a certificate?
Yes, we could get more detail info from the official document .
To secure your custom domain name with HTTPS, you bind a custom SSL certificate to that custom domain in Azure.
Before binding a custom certificate, we need to do the following:
Configure the custom domain - App Service only allows adding a certificate for a domain name that's already configured in your app. For instructions, see Map a custom domain name to an Azure app.
Scale up to Basic tier or higher App Service plans in lower pricing tiers don't support custom SSL certificates. For instructions, see Scale up an app in Azure.
Get an SSL certificate - If you do not already have one, you need to get one from a trusted certificate authority (CA).
Yes, if you use a custom host name, then you will need to have a certificate for it. There is really no way around this, based on how SSL works.

SSL Root Certificate Name vs OAuth

Currently have a multisite SSL certificate with root certificate name of b.mysite.com and used in both sites of a.mysite.com and b.mysite.com
When third party application trying to communicate with both sites using oauth, the b.mysite.com works but not a.mysite.com
Could this be an error in naming the root certificate name? or something else?
Note: Before implement SSL, oauth works on both sites.