Activate SSL certificate HTTPS for TYPO3

Integrate SSL certificate Typo3
SSL certificates are required by the GDPR and must be integrated.

First, a certificate is ordered via the provider, for example.

The easiest way to integrate a certificate into the website is to enter a redirect in the .htaccess file.

The file is usually located in the root directory of the TYPO3 installation. This code is then added at the bottom, which executes a redirection to https.

Translated with www.DeepL.com/Translator (free version)

There are various certificates:

SSL certificates (Secure Sockets Layer) are digital certificates that confirm the identity of a website and enable an encrypted connection between a web server and a browser. There are different types of SSL certificates, which differ mainly in the level of verification and the number of domains or subdomains covered. Here are the most common types:

1. domain validated certificates (DV)

• Description: Confirms that the applicant has control over the domain.
• Verification process: Simple; only requires proof that the applicant can control the domain, typically through email verification or uploading a special file to the server.
• Use: Suitable for personal websites or smaller projects where basic security is sufficient.

2. organisation validated certificates (OV)

• Description: Confirm the existence and legitimacy of the organisation in addition to control over the domain.
• Verification process: More comprehensive; requires additional documentation to confirm the organisation.
• Use: Recommended for corporate websites where trust and authenticity are important.

3. extended validation certificates (EV)

• Description: Provide the highest level of trust and authenticity.
• Verification process: Rigorous; requires a thorough review of the organisation, including confirmation of company status and legal existence.
• Usage: Ideal for e-commerce websites and any type of business involving financial transactions or personal data entry.

4. wildcard certificates

• Description: Cover all subdomains of a domain.
• Verification process: Similar to DV or OV certificates, depending on the level of validation chosen.
• Usage: Useful for companies or projects that operate multiple subdomains.

5. multi-domain certificates (SAN/UCC)

• Description: Allows multiple domains and subdomains to be secured with a single certificate.
• Verification process: May vary depending on validation level.
• Usage: Ideal for organisations operating multiple services under different domains.

The main difference between these certificates lies in the level of verification and authenticity as well as the number of domains or subdomains covered. While DV certificates are quick and easy to obtain, OV and EV certificates offer a higher level of security and trustworthiness. Wildcard and multi-domain certificates offer flexibility for organisations with multiple domains or subdomains.

What is HTTPS, SSL and TLS?

HTTPS stands for "HyperText Transfer Protocol Secure". A secure transfer protocol for websites. With the simple HTTP method, which always precedes the URL, the data is transmitted in plain text and could therefore be read, provided you have the necessary expertise.

The two transmission protocols HTTP and HTTPS are identical in terms of content, but HTTPS is made unreadable to outsiders via the SSL/TLS encryption protocol.

Applying for an SSL certificate

Firstly, a certificate must be ordered from the provider. This is available in different levels. Some providers issue one free of charge, further certificates then cost X amount per month.

There is also the option of integrating free certificates.

There are several free options for securing websites that offer domain validated (DV) SSL certificates. These are particularly useful for personal projects, blogs or smaller websites where basic encryption is sufficient. Here are some of the most popular providers of free SSL certificates:

1 Let's Encrypt

Description: A widely used, free service operated by the Internet Security Research Group (ISRG). Let's Encrypt aims to make the entire Internet more secure by giving everyone the opportunity to obtain an SSL certificate free of charge.

Special features: Automatic renewal, easy implementation.

Usage: Very popular with web hosting providers and is often supported directly via the hosting control panel.

2. zeroSSL

Description: Another free alternative that offers simple DV SSL certificates. ZeroSSL has a user-friendly interface and also provides tools to manage certificates.

Special features: Easy handling via web interface or API, support for ACME (Automated Certificate Management Environment).

Use: Well suited for developers and small companies looking for a simple solution.

Translated with www.DeepL.com/Translator (free version)

3 Cloudflare

Description: Cloudflare not only offers free SSL certificates as part of its website optimisation and security services, but also protection against DDoS attacks and improved performance through its global Content Delivery Network (CDN).

Special features: SSL encryption is provided between the visitor and Cloudflare's network, and optionally between Cloudflare's network and the user's origin server.

Usage: Ideal for websites looking for both security and performance optimisations.

4. SSL For Free

Description: Based on Let's Encrypt, SSL For Free provides an easy way to get free SSL certificates. The website offers a simple interface for generating certificates.

Special features: Uses Let's Encrypt in the background; simple manual procedure for certificate generation.

Use: Suitable for users who want to generate and install certificates manually.

These free services offer an excellent way to secure your website and increase the trust of your visitors at no additional cost. However, it is important to note that free SSL certificates are usually only DV certificates and may not be suitable for all types of websites or online businesses, especially if a higher level of authentication (such as with OV or EV certificates) is required.