Hosting a secure site on a dedicated server

[omarfilip]

I have an opportunity to host a site which ought to be secured (https) on my dedicated server at GH, but I have no idea where to begin.

This would be under one domain name and the need is to secure a form where users would submit a mortgage application, and that includes SSNs.

Where do I begin?

Thanks.

[Alexander]

Hi, first of all, you need to have a free dedicated IP for this account. If you have such, assign it to this account. After that, order SSL cert, and as soon as you get it, install in your WHM. You can order SSL through us or using any third-party.
GH provide COMODO SSL certs, if you are interested, please, visit http://glowhost.com/more-products/ssl-certificates/index.php

[omarfilip]

Thanks, Alex. The Comodo link just goes back to the forums landing page...

So, what does this SSL certificate do for me? Is it just a way of saying I am who I am, or is there more?

[Matt]

I've fixed the link, please try it again.

SSL encrypts the data transmission between the client's PC and the server so that sensitive data like SSN cannot be intercepted by third parties for malicious use.

Once you have the data on the server you would want to encrypt it using mysql encrypt() and decrypt() or similar strong encryption functions so that if someone gains access to your DB the information is not in plain text for the world to see.

[omarfilip]

Would sending the submitted form data by email to the mortgage broker be considered insecure?

[AndrewGlow]

Hello. That's normal, I think. But yes, it seems to be unsecure. Anyway you can email a link to a secured page where broker would login using his username/password and will get information.

[Matt]

Email is definately not a good way to send any time of data but unfortunately there are lots of firms that still send CC and SS numbers via unencrypted email. Sending it in a encrypted and compressed archive with password authentication to deflate the file would be better, but still not a 100% great solution.

[omarfilip]

Do you guys know of an open source solution for secure forms before I start searching the web for one?

[GlowAlex]

You can try the site below:

phpFormGenerator - create professional web forms in minutes

This is also available in Fantastico so you can easily install and test it on your hosting account.

[rlhanson]

Omarfilip -
In my expereince with clients that want to offer some sort of application processing I've explained to them that the email form is not meant to transmit SS# or other sensitive information.

We've created the app form to only ask for the last 4 of the SS# (or not asked for it at all) and placed a "check here" to acknowledge that you will have to verbally supply this information in order for your application to be processed.
This usually works as the client normally is contacting the applicant for the credit check fees anyway...

On the flip side, sometimes whoever they are securing the financing from (on behalf of the applicant) has solutions available to link from the client site to the lender site's secure application process.
I have one client that processes through rentmanager.com who offers a unit availability and online application process...