What happens when you setup the free GeoTrust SSL certificate on 1and1? - ssl

Question

1and1 UK hosting provides you with a free GeoTrust SSL certificate for your website.
But not wanting to break my existing site(s) I want to know beforehand what happens when you set it up.
Currently I have setup my webspace like this:
/www <-- www.foo.com
+-- /images
+-- /css
/test <-- test.foo.com
+-- /images
+-- /css
I only want the SSL cert for the www.foo.com website.
The documentation tells you how to setup the certificate - but not what happens when you do.
Is it as easy as it creates a new top level dir called /www-ssl ? If so I could just copy the site into there and work with that.
Thanks.

Answer 1

Funnily enough the original question is actually something I've
actually just finished rolling out over the last two days.
If you are just using 1and1's webspace/domains (not server) it's pretty straight forwards (it doesn't change files, it doesn't automatically make the site SSL). It will continue to run as a HTTP server until you start editing your .htaccess files to redirect to HTTPS.
You should be aware: If you intend to use 1&1's CDN and want SSL, the free one they gave you won't work with it. (I'm guessing it's
down to how the automated process for creating CNAME's in the zone
record conflicts with each other. It's also incidentally why you need
to make sure you are using 1and1's NS's so they have control over the
zone record to do alterations for setting up the CDN or Geotrusts SSL
Cert)
you will either have to buy the CDN package with SSL cert (which is more expensive) or you can do what I've done:
Set up the Free Geotrust SSL Cert for your server
turn OFF/Remove the 1and1 CDN (if you've set it up)
Visit https://www.cloudflare.com and sign up for a free account, Only set this up once you have the Geotrust Cert running on your server as it will require changing your domains NS's to cloudflares one in your 1and1 adminpanel which would cause problems with any automatic subdomain creation used by 1and1).
The difference between using 1and1 CDN & SSL and SSL & Cloudflare is the latter version is cheaper (it uses whats free and what you already have, as well as having more CDN options available to you.) and the only thing you lose from it is Mirage caching (image optimisation for mobiles, which is in beta) You can of course pay cloudflare to get that option (and other extras) but to be honest it's a small loss.
There is a difference between the Geotrust SSL and the SSL Starter certs.
The Geotrust SSL Cert will handle both foo.com, www.foo.com.
The starter SSL will only handle one of them, not both.
If that checks out Setup your GeoTrust SSL certificate to handle both www.foo.com and foo.com
Once you've got your cert just add the below to a .htaccess file (It assumes that foo.com traffic is also www.foo.com traffic)
<If "%{REQUEST_SCHEME} =='http' && (-f %{REQUEST_FILENAME} || -d %{REQUEST_FILENAME})">
Redirect permanent "/" "Https://foo.com/"
</If>
<ElseIf "(%{HTTP_HOST} == 'foo.com') && (-f %{REQUEST_FILENAME} || -d %{REQUEST_FILENAME})">
Redirect permanent "/" "Https://www.foo.com/"
</ElseIf>
This can be used instead of mod_rewrite in apache >=2.4
REQUEST_SCHEME is used since the server isn't using a FULL(Strict) method where the server itself is set to run in HTTPS. Certain mod_rewrite rules will actually cause infinite* redirect loops. (*until the server timeouts from recursion)
While it is possible to reduce this so you have less redirects, if you intend to further tighten your SSL if you use cloudflare, you'll likely end up using HTTP Strict Transport Security (HSTS) and it's strict in how HTTP is escalated to HTTPS. The Pseudocode below shows the elevation it requires (having to do it this way due to limited links being allowed here):
http(domain) >301> https(domain) >301> https(sub+domain)
I'm not entire sure how the HSTS protocol would handle how I initially intended the failure of a File/Directory not being found creating a 404 message that breaks it's strict redirects.
(If you use this method, sanitise how the 404 message is handled since it can be outside of HTTPS.).
As for test.foo.com test folder. You can just treat that as you
have already, it's outside of the SSL Cert and not handled by the
.htaccess of the www folder.
If/When you get to looking at setting up HSTS, you will want to add headers to your If/ElseIf statements.
<If "%{REQUEST_SCHEME} =='http' && (-f %{REQUEST_FILENAME} || -d %{REQUEST_FILENAME})">
Redirect permanent "/" "Https://foo.com/"
Header set Strict-Transport-Security "max-age=2592000; includeSubDomains; preload" env=HTTPS
</If>
<ElseIf "(%{HTTP_HOST} == 'foo.com') && (-f %{REQUEST_FILENAME} || -d %{REQUEST_FILENAME})">
Redirect permanent "/" "Https://www.foo.com/"
Header set Strict-Transport-Security "max-age=2592000; includeSubDomains; preload" env=HTTPS
</ElseIf>
I hope that helps,

Answer 2

Edit
To clarify, the question seems to be more about how TLS works rather than how to get around it.
A TLS certificate is an agreement between a website and a browser to use a common shared secret to send and receive encrypted communications between each other. This is NOT anything that changes the website content or the website data. It is simply a more secure transport system.
Imagine, you're trying to send out magazines to customers in the real world, and you post these magazines in thin, skimpy plastic wrappers with the address in the corner, that's ok, that works, but the postman, the whole postal working staff and anyone whose popping into the post office at the time will be able to see what you're posting, and what magazine your friend is receiving.
So, you update and instead post your magazines out in thick dark paper bags, with duct tape wrapping, this means no one in-transit can view the magazine and no one knows what magazine is contained within the paper bag. This is a very rough equviliant of what TLS does for the website, it doesn't change the website contents (the magazine) but it does ensure that this contents is much, much harder to sniff and read.
By saying you want to encrypt some websites but you don't want to encrypt others, this seems somewhat odd, as surely all customers (in the scenario painted above) would like their magazines delivered in thick paper bags rather than thin transparant plastic wrappers. As there is no cost involved, there is little gain if any in only encrypting some of your sites or data.
Historic Original Answer:
A TLS certificate can be enabled for any site but is not required unless you tell the site to require it. What you can do is set the certificate for your account (and this will cover all domains on the account including subdomains, unless there's a specific setup option to avoid subdomains) and then use htaccess to tell the server to clarify your actions, so you can tell the server that:
RewriteEngine On
rewriteCond %{HTTP_HOST} ^www.(.*)$
rewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
So this will tell your server that if the www.site.whatever is accessed then to use HTTPS... And you can, if you really want, use a similar inverted rule to prevent the non-www subdomain using the secured TLS port, but really, why wouldn't you want to use TLS encryption for all your web data?