[web] Secure HTTP under PHP

HTTP and HTTPS aren't really related to php in any way, its just the protocols responsible for transfering the data.

Thus you don't have to do anything special in php.
(Its all in the hands of the webserver)

as far as certificates go: no not really, you can get them for free:

here for example (just google for free ssl certificate)
http://cert.startcom.org/
http://www.rapidssl.com/index_ssl.htm

However it seems like some certificates use weaker keys than others so you might get "better" certificates by paying for it.

It is also possible to sign your own certificate: However most webbrowsers will generate a warning notifying the user of the fact that the certificate isn't issued by a trusted party.
http://www.akadia.com/services/ssh_test_certificate.html

Quote:

Original post by Prozak Do we need to buy a certificate or something?

Yes, a free certificate is worth nothing. You pay for trust.

Quote:

Original post by Konfusius Quote: Original post by Prozak Do we need to buy a certificate or something? Yes, a free certificate is worth nothing. You pay for trust.

Well not quite, SSL requires a certificate, without one you won't get any encryption.

If you mainly want the encryption and don't worry too much about users trusting you. (for say online forums, etc and the main concern is to avoid people at school networks or similar stealing eachothers passwords) a free or self-signed certificate is good enough.

If you need your users to trust you. (Your site handles creditcard payments or any other important information) you should go with something like verisign.

Browsers come with a white list of trusted SSL certificates. If you use a self-signed one or one from an unknown provider, the user will get warning messages. Your traffic will still be encrypted (assuming they accept the cert). IE 6+, Firefox, and Opera all support just about any certificate you can buy, but obviously check the browser compatibility list before you get one.

There's not a whole lot of difference between different certs. The major one is the encryption strength. Higher encryption is harder to break (and thus more safe), but puts a larger strain on server.

Besides that, you pay for name brand recognition. That is mostly a worthless sales gimmick. Barely anyone bothers to check to see who signed your cert, as long as the browser gladly accepted it. That is, you can pay big dollars for Verisign to check to make sure you have an authentic business. Or you can pay a few dollars to have some other provider simply make sure your e-mail matches the domain name owner.

None of this has anything to do with PHP.