What should be done when moving a site to HTTPS?

Question

Web servers

Good afternoon. I never asked this question, but an order came at work to transfer the site to the HTTPS protocol.

Googling, I realized that I need to buy an SSL certificate for the site.

But there were questions

1) Will the server be additionally loaded if the site works via HTTPS
2) Do I need to configure it? If so, where. Apache / IIS or this setting at the domain level?

Answer 1

To transfer the site to https, it all comes down to copying the two files key.pem and certificate.cer and adding them to the settings. For Apache:

<VirtualHost *:443>
    ServerName mysite.com

    SSLEngine on
    SSLCertificateFile /home/mysite/certificate.cer
    SSLCertificateKeyFile /home/mysite/key.pem
</VirtualHost>

The certificate can be purchased - the issuing organization thereby confirms that the site belongs to such and such an organization. Also, the certificate can be "self-signed" (self-signed) - when you yourself confirm that the site is yours, naturally anyone can do this and browsers will swear that the certificate is unreliable.

Answer 2

1) Look at the Hosting and Domain Registrar what offers they have for SSL certificates, maybe there is a free one or you can buy it
2) Yes, you need to configure it all depends on what you are using

Answer 3

If you don't have a selling website, LE is enough. If selling - buy an OV-certificate from large suppliers, it is more expensive, the issuance is more difficult, but more prestigious :) Alexander
has already written about setting up Apache . You can also add the following:

SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite kEECDH+AES:kEDH+AES:kRSA+AES:!aNULL:!DSS:!SSLv2
    SSLHonorCipherOrder on

the first line disables support for old leaky protocols.
the second line specifies to use only modern ciphersuites with strong cryptography. If the site will be visited with WinXP, old androids - do not install it. The
third line specifies to use the cipher suites set by you, and not by the client (which may have a weak and vulnerable cipher suite)