Resources

  • StartSSl: offers free domain-verified certificates. You can’t beat free. Stepping up to higher grades of verification is, of course, both possible and reasonably priced.
  • SSL Server Test: Once you’ve set up HTTPS for your servers, verify that you’ve done it right by running it through SSL Labs’ server test. You’ll get a nicely detailed report that shows you whether you’re really up and running.
  • Ars Technica’s recent article “Securing your Web Server with SSL/TLS” is worth reading for a little more background detail about the nuts and bolts of setting up a server.
  • The HTTP Strict Transport Security specification (RFC6797)is worth skimming for all the technical information about the Strict-Transport-Security header you could possibly want.