Purchasing an SSL Certificate

• SSL (Secure Socket Layer) is an encryption protocol that enables secure communication on the Internet. It protects sensitive data such as credit card information, hospital records, passwords, etc, during passage over a network. An SSL Certificate, purchased from a third party, establishes SSL functionality for a specific web transaction.


• The Vice President’s office has mandated that all financial dealings should be processed through a third party vendor. The Cash Management office has also stated that all financial transactions must be secure from start to finish. This means that any page on a Duke website that enables someone to go to a third party site to pay for something must also be secured using an SSL certificate.


• SSL certificates are sold by several vendors. They cost from $118 to $180 per year, with additional discounts applicable if you purchase additional years up front.


• A&SIST does not pay for certificates. This is a regular business expense approved for purchase by Duke p-card holders. Check with your purchasing director if you have questions. A&SIST will be happy to talk to your purchasing director, and/or put them in touch with other departments which have purchased certificates, if they have questions.


• Contact your web sysadmin (admin@aas.duke.edu in Arts & Sciences) to request help in buying an SSL certificate using the Duke IT security office's process.

Process:

• The site owner/web developer provides the sysadmin with the following information:
  • URL of the site requiring the certificate. It will need its own (usually 4th level) domain.
  • Division/department name.
  • Email addresses of the administrative/purchasing contact (p-card holder), the technical contact (sysadmin) and the web contact (site owner or web developer).
    
• The sysadmin, together with the p-card holder, orders the site certificate.


• The certificate is emailed to the web developer/site owner, who then forwards it to the sysadmin for installation.