14.4DNS and SSL Configuration

SSL/TLS encrypts the connection between browser and server. A site using it has an address starting with https:// and shows a padlock. (SSL is the old name; the modern protocol is TLS, but "SSL certificate" is still the common term.)

Why HTTPS is essential: protects passwords, personal data and payments from eavesdropping; prevents tampering with page content; builds trust (browsers mark HTTP sites "Not secure"); required by payment gateways; and gives a small SEO advantage. Browsers will not send secure cookies over plain HTTP.

How it works (simplified): the server holds a certificate issued by a trusted Certificate Authority (CA) that proves it is really myshop.lk. During the TLS handshake the browser verifies the certificate, then both sides agree on a secret key used to encrypt everything.

Installing a certificate: common routes

1. cPanel AutoSSL / Let's Encrypt (most shared hosts): SSL/TLS Status, then Run AutoSSL. Requires that the domain's DNS already points to the server. Renews automatically.
2. Cloudflare in front of your site (free plan): change nameservers to Cloudflare, turn on SSL mode Full (strict) after you have a valid certificate on the origin server.
3. VPS with Certbot: sudo certbot --apache -d myshop.lk -d www.myshop.lk obtains and installs a Let's Encrypt certificate and sets up renewal.
4. Purchased certificate: generate a CSR, submit to the CA, validate the domain (DNS TXT record, email or file), install the issued certificate and chain.

Force all visitors to HTTPS by adding this to .htaccess in public_html (Apache):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Also update: absolute links and image URLs to https://, the payment return_url and notify_url, and set the session cookie secure flag to true. Mixed content (an HTTPS page loading an http:// image or script) breaks the padlock; fix it by using HTTPS or relative URLs. Optionally add the HSTS header so browsers always use HTTPS:

header('Strict-Transport-Security: max-age=31536000; includeSubDomains');

Email-related DNS (to avoid spam folders): SPF (TXT, which servers may send for you), DKIM (TXT, a signing key from your mail provider), DMARC (TXT, policy). Your email provider gives you the exact values to paste.

Typical complete go-live sequence