secure site

[Guest]

Hello,
I had my connection string defined in web.config, now I want to have my
asp.net application as a secure site with https://, how should I do this?
Thanks,
Jim.

 

[Scott Allen]

Hi Jim:

Using SSL (https) doesn't require any changes in the web.config.
You'll need to get a certificate for your server, install it, and
configure IIS to use SSL. There are a couple ways to get a free cert
for testing (or permanent use, if this isn't an Internet site).

Some details here:
http://support.microsoft.com/kb/q298805/

 

[Guest]

Hi Scott,
Thanks for reply.
1. If it is not a connection to SQL server, Where exactly SSL is in use?
What part of web site is secured by SSL?
2. Do I really need it, or it is only third part confirmation that the site
is legitimate?
3. Do you know a web site I can get free certificate?
Thanks,
Jim.

 

[Scott Allen]

Hi Jim:

See inline

Hi Scott,
Thanks for reply.
1. If it is not a connection to SQL server, Where exactly SSL is in use?
What part of web site is secured by SSL?

Well, you can connect to SQL Server using SSL, but I was assuming you
wanted the web site to require clients to use SSL. Typically you only
need SSL between the application and SQL Server if the network path to
the database is on an insecure network, otherwise it is just overhead.

2. Do I really need it, or it is only third part confirmation that the site
is legitimate?

HTTPS has two purposes - it encrypts the traffic between the server
and client so that noone can snoop on the data. A certificate also
proves that the server is who it claims to be. Like I'd want to be
sure the amazon.com web server is really amazon.com before I hand over
my credit card information.

3. Do you know a web site I can get free certificate?
Thanks,

Do you have a server version of Windows handy? If so, you can generate
your own certificates for internal use and test. If you are building
an internet site you'll have no choice but to buy a real certificate
from a trusted authority. I don't know if any of them offer a free
certificate, but I doubt it.