asp.net - How to make a website secured with https

Question

I have to build a small webapp for a company to maintain their business data... Only those within the company will be using it, but we are planning to host it in public domain, so that the employees can connect to app from various locations. (Till now I have built web apps that are hosted internally only)

I'm wondering whether I need to use a secured connection (https) or just the forms authentication is enough.

If you say https, I have some questions :

1. What should I do to prepare my website for https. (Do I need to alter the code / Config)
2. Is SSL and https one and the same...
3. Do I need to apply with someone to get some license or something.
4. Do I need to make all my pages secured or only the login page...

I was searching Internet for answer, but I was not able to get all these points... Any whitepaper or other references would also be helpful...

Feel free to ask incase you need more information.

Thanks

• Raja

Answer 1

What should I do to prepare my website for https. (Do I need to alter the code / Config)

You should keep best practices for secure coding in mind (here is a good intro: http://www.owasp.org/index.php/Secure_Coding_Principles ), otherwise all you need is a correctly set up SSL certificate.

Is SSL and https one and the same..

Pretty much, yes.

Do I need to apply with someone to get some license or something.

You can buy an SSL certificate from a certificate authority or use a self-signed certificate. The ones you can purchase vary wildly in price - from $10 to hundreds of dollars a year. You would need one of those if you set up an online shop, for example. Self-signed certificates are a viable option for an internal application. You can also use one of those for development. Here's a good tutorial on how to set up a self-signed certificate for IIS: Enabling SSL on IIS 7.0 Using Self-Signed Certificates

Do I need to make all my pages secured or only the login page..

Use HTTPS for everything, not just the initial user login. It's not going to be too much of an overhead and it will mean the data that the users send/receive from your remotely hosted application cannot be read by outside parties if it is intercepted. Even Gmail now turns on HTTPS by default.