5 Securing Rock with SSL 3 Jon Horton posted 9 Years Ago This is more of a suggestion than a question, but I just wanted to speak for a moment to the issue of security in Rock. On our team, we've begun placing a high value on the security of our data. As developers, our people are entrusting us with their information, and we want to be good stewards of that information. One of the ways we've taken steps to do this is by securing any site we build with an SSL certificate. This is a simple, yet effective way to encrypt information as it travels through the internet. Not only does it encrypt user data, but there are also other benefits like Google using HTTPS as a search ranking signal. My suggestion is simple: as you install Rock and begin using it with actual information from people in your church, make sure you purchase and configure an SSL certificate before making it available at a publicly accessible domain. Prices range from $9–$100+ per year, and while the setup may seem daunting, there are plenty of helpful tutorials that walk you through the setup process. We currently use Namecheap to handle all of our SSL certs, but check with your current registrar to see if they offer SSL Certificates. If you're new to SSL, Google provides a detailed list of best practices. I hope this is a start on how to make Rock as secure as possible as we steward our people's information well. Let me know if you have anything to add!
Jim Michael 9 years ago I think a wildcard is a great idea since it (as you say) lets you secure any number of subdomains with the same cert. Way back in the day some devices had trouble with wildcard certs, but those days are long gone. We are big fans of Digicert here... not the cheapest, but great support and great instructions for creating and installing certs on just about any platform.
Trey Hendon III 9 years ago I fully agee with Jim. The only downside to a wildcard is it's price. If you can afford it, they provide the most flexibily further down the road when the need arises for additional Rock driven sites for special projects. For example, we're about to build a capital campaign web site and it can just use my existing cert and I don't have to buy a new certificate and install it in place of anything. Buying a traditional cert means you have to plan out any domains you might ever need for the life of the certificate.
Jon Horton 9 years ago Matt: Yep we used a wildcard cert since we have several subdomains we wanted to secure. We purchased a Comodo PositiveSSL cert through Namecheap: https://www.namecheap.com/security/ssl-certificates/comodo/positivessl-wildcard.aspxIt wasn't that expensive either—only $94/yr!