{"id":2277,"date":"2020-11-13T10:55:18","date_gmt":"2020-11-13T09:55:18","guid":{"rendered":"https:\/\/netcloudengineering.com\/?p=2277"},"modified":"2021-08-09T03:02:19","modified_gmt":"2021-08-09T02:02:19","slug":"hsts-certificado-seguridad","status":"publish","type":"post","link":"https:\/\/netcloudengineering.com\/en\/hsts-certificado-seguridad\/","title":{"rendered":"Why integrate HSTS into a security certificate?"},"content":{"rendered":"

Four years ago, Google formally implemented a security policy called HTTP Strict Transport Security (HSTS). Shortly after, highly prestigious social networks (Facebook, Twitter, Gmail ...) and payment portals such as PayPal, incorporated HSTS to the SSL of their platforms. With this action, multimillion dollar companies sent a message to the world about the importance of integrate HSTS to a security certificate<\/strong>.<\/p>\n

At that time, many wondered how Strict Transport Security worked and why it was so important to implement this security standard on a website. After the need to understand what the HSTS was about, we discovered that its main purpose was ensure the connection between users and web servers.<\/strong><\/p>\n

Integrating HSTS into a security certificate: How, when and why to implement it?<\/strong><\/h2>\n

Currently, Strict Transport Security is more current than ever, it has become an essential element for online platforms. Many businesses are on the Internet, it is normal to want know if your website is safe and secure<\/a> of attacks.<\/p>\n

For this and other reasons, in this article we want to highlight the importance of integrate HSTS to a security certificate<\/strong>. \u00a0<\/strong>Although, for this, it is essential to first know what an SSL certificate is and how Strict Transport Security works.<\/p>\n

What is SSL certificate?<\/strong><\/h3>\n

A Secure Socket Layer certificate (or SSL<\/a>) is a kind of digital code that connects a company to an Internet domain name. It is the equivalent of a property right that an organization obtains to use land.<\/p>\n

The use of this certificate reveals to web browsers that it is only possible to enter the page through a secure connection<\/strong>.<\/p>\n

In fact, identify<\/strong> a website with SSL certificate<\/strong> Valid is very easy: just take a look at the address bar where a padlock symbol should appear accompanied by the name of the organization and the HTTPS protocol.<\/p>\n

The HTTPS protocol is a ranking element in Google that gives a website the distinction of \u201cfive stars\u201d. For example, a page with SSL could be interpreted as a secure, fast and mobile responsive portal.<\/p>\n

However, just because a website has an SSL certificate does not mean that the portal is completely safe for visitors<\/strong>. We explain why.<\/p>\n

In a physical context, we could say that the certificate acts as a security guard located at the entrance of a store. Normally, this guard is able to stop many threats at the gate, but unfortunately, he will not be able to provide protection to the place if some malicious visitor finds another way to gain access.<\/p>\n

It is precisely at this point where the decision to integrate HSTS to a security certificate <\/strong>it would not be for pleasure. And it is that the role of Strict Transport Security in this case would be to force everyone to access the store through a single entrance.<\/p>\n

What is it<\/strong> HSTS? <\/strong><\/h3>\n

It is a security policy that allows different websites to be named as a navigable space through secure connections (HTTPS). The HSTS standard protects both web portals and users against possible protocol degradation and cyber attacks to hijack cookies.<\/p>\n

Therefore, if a web page implements an HSTS policy, the browser should automatically deny HTTP connections and prevent users from approving insecure SSL certificates.<\/p>\n

In short words; the objective of this security policy is avoid attacks <\/strong>of intermediaries using SSL.<\/p>\n

Today you can integrate HSTS to a security certificate <\/strong>without problems because it is compatible with almost all the browsers that we know.<\/p>\n

\"Resaltar<\/p>\n

Why should you implement HSTS on your company website? <\/strong><\/h3>\n

Suppose you have a physical store, as the owner or manager of the business, we are sure that you will never close the doors of the store without padlocking the doors. In fact, it would not be surprising that you also place metal detectors at the entrance to prevent visitors from entering with the intention of taking your products.<\/p>\n

In this way, your website data is as valuable as the products in your physical store<\/strong>, so it is very important to keep them safe under lock.<\/p>\n

Do you wanna know the truth? Blocking your company's website is sometimes not enough because there are those who find a way to access the site through http: \/\/. In this case, HSTS requires visitors and application connections to use HTTPS.<\/p>\n

Therefore, at\u00a0 integrate HSTS to a security certificate<\/strong> or having a Strict-Transport-Security header installed in your browser will make it virtually impossible for users with aspirations to steal your website data to collect information.<\/p>\n

Keys to how the HSTS policy works<\/strong><\/h3>\n