19

We have 2 Rails app (one for front end and other for backend(api) hosted on 2 different servers. User comes to our front end app and fills the order form. We then send json request to backend and backend send confirmation json response to front end. Backend is only accessible from our office address and is setup to communicate to only our front end app.

Today we purchased EV ssl certificate for our front end app from DigiCert and everything is work fine. But since we don't have ssl certificate on backend, does that means that what ever data we are passing from our front end to backend will be unencrypted?

  • Do we need ssl certificate for both front end and back end servers?
  • Our backend only servers request to our front end app and no other clients are connect to our backend? So can I use a self-signed or cheap SSL certificate for backend?
  • Or shall I buy another ssl certificate from DigiCert? (bit expensive)

I have already gone through couple of stack overflow questions, and looks like suggestion is to install ssl in both servers. This is my first time trying to set up ssl certificates on servers, so just want to double check before I buy another ssl certificate for our backend app.

Update

I found few cheap ssl certificate provides, what are people suggestions towards cheaper provider like this one https://cheapsslsecurity.com.au/

5
  • 1
    Yes, you will need SSL for your backend. that is the important place where all the logic and data is being stored. On the front-end not so important, but if you are tackling with payment or any other confidential information yes, you do need it in front-end.
    – Smit
    Commented Feb 23, 2017 at 5:01
  • @Smit, yes our app is financial app thats why we preferred to show green secure bar to users for our frontend app. So can I use self signed ssl for backend or would you suggest to buy it ?
    – r3b00t
    Commented Feb 23, 2017 at 5:03
  • Check the answer posted! To help you understand. Inputs are welcomed.
    – Smit
    Commented Feb 23, 2017 at 5:14
  • Don't use code formatting for text that isn't code.
    – user207421
    Commented Feb 23, 2017 at 6:19
  • Will keep that in mind for future @EJP. Thanks for edit.
    – r3b00t
    Commented Feb 23, 2017 at 8:34

2 Answers 2

20

SSL only encrypts data between the server and the client.

It does not make a server secure.

It only prevents sending unencrypted data over the all the little hops that data makes between client and server.

Your back-end may be in a completely separate geo location or in the the server farm next door. But, it still may travel through several routers to get there. Without SSL, the data is sent in the raw. I have a few servers, some in a different rack with the same host, and some are hundreds of miles apart. Going from rack to rack in the same geo loaction still requires hops over various routers -assuming no VPN. So, yes, if you are very paranoid and do not have a VPN between the front end and back-end, then secure the back-end. But all this does is encrypt the data between the two. It does not make a server 'secure'.

What does this mean? Asuming your back end has no http presence (not discoverable on the web) then SSL on the backend is probably overkill. Why? Becaue the only people who know it exists are employees - and no amount of SSL is gonna protect the server from anyone who knows it exists or how to access it.

Neither will SSL protect you against other attacks such as SQL Injection. For example, the Equifax breach which Equifax claim was a bug in Apache Struts (although my guess is that there was more to that than meets the eye).

SSL is a band-aid on a flawed system. It does not make a server secure. All it does is encrypt data between the server and the client.

11

Yes, you will need SSL for your backend. that is the important place where all the logic and data is being stored. On the front-end not so important, but if you are tackling with payment or any other confidential information yes, you do need it in front-end.

Risk of Using Self-Signed on Public Sites

The security warnings associated with self-signed SSL Certificates drive away potential clients for fear that the website does not secure their credentials. Both brand reputation and customer trust are damaged.

I will totally agree with this article, not to use self-signed SSL, especially when dealing with payment. For internal testing, you may. But while in production, highly recommended not to use it. Instead go with SSLs that are with Certificate Authority

Ref: https://www.thawte.com/ssl/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.