- \n
- What’s the importance of it?<\/a><\/li>\n
- Why do we use it?<\/a><\/li>\n
- The Key(s) to the Authentication Process<\/a><\/li>\n
- Setting up SSH in The Hub<\/a><\/li>\n<\/ul>\n<\/li>\n
- What is SSL?<\/a>\n
- \n
- Why do we use it?<\/a><\/li>\n
- Authentication Process<\/a><\/li>\n
- What\u2019s the Importance of It?<\/a><\/li>\n
- Getting Set Up in the Hub<\/a><\/li>\n
- Custom SSL Certificates<\/a><\/li>\n<\/ul>\n<\/li>\n
- A Little Bit on TLS<\/a><\/li>\n
- Differences Between SSH and SSL\/TLS<\/a><\/li>\n
- Feel Secure Yet?<\/a><\/li>\n<\/ul>\n
![\"Dev](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/Untitled_Artwork.jpg\")
By the time you\u2019ve read this, confusion will end and all will be revealed.<\/figcaption><\/figure>\n To get started, it\u2019s important to know what SSH and SSL are. So…<\/p>\n
<\/a>What is SSH?<\/strong><\/h2>\n
SSH<\/strong><\/a> (secure shell) is a way to communicate with a remote computer securely. It\u2019s used for executing commands remotely.<\/p>\n
So, for example, if you\u2019re on vacation in the Bahamas, you can access your work website remotely, perform commands<\/a>, and edit (although, why would you do this on such a great vacation?).<\/p>\n
It does this by interacting with another system\u2019s operating shell and functions by using public-key cryptography for connection and authentication.<\/p>\n
This makes gaining access to a WordPress site possible in a secure way<\/a> to ensure nobody has access to your connection while you\u2019re on it.<\/p>\n
<\/a>What\u2019s the Importance of It?<\/strong><\/h3>\n
It\u2019s important because it secures all of the unsecured networks in the client and server connection.<\/p>\n
The client uses the remote host information to initiate a connection, and, when the credentials are verified, it establishes the encrypted connection.<\/p>\n
On the server-side, there\u2019s an SSH daemon that\u2019s regularly listening to a specific TCP\/IP port<\/a> for a potential client connection request.<\/p>\n
When a client initiates a connection, the SSH daemon will get back to it and reply with the software and the protocol versions it supports.<\/p>\n
The two exchange their identification data and (if the credentials pan out) create a new session for the appropriate environment.<\/p>\n
<\/a>Why Do We Use It?<\/strong><\/h3>\n
People use SSH to securely communicate with another computer. By using it, the exchange of data is encrypted through the internet pathways.<\/p>\n
This ensures that anyone who might see the data, who isn\u2019t supposed to, would not be able to see what was in the data.<\/p>\n
With SSH, you can then access sites and use commands<\/a> to perform various functions (e.g. add a new file from the Bahamas).<\/p>\n
<\/a>The Key(s) to the Authentication Process<\/strong><\/h3>\n
The authentication is pretty straightforward and simple.<\/p>\n
It starts with creating a key pair, which the user typically does with ssh-keygen<\/a>. Private keys stick with the user, while the public key goes to the server.<\/p>\n
A server stores the public key and marks it as authorized. From this point, a server will now allow access to anyone who can show proof that they have the corresponding private key.<\/p>\n
The private key is typically kept private by a user developing a passphrase for it.<\/p>\n
Then, when a private key is needed, the user has to supply the passphrase so that the private key can be decrypted.<\/p>\n
![\"how](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/how-SSH-works.png\")
How SSH works.<\/figcaption><\/figure>\n <\/a>Setting up SSH in the Hub<\/strong><\/h3>\n
If you\u2019re new to WPMU DEV or do not have an account with us, The Hub<\/a> is where you can manage, update, monitor, scan, and manage WordPress sites, all in one place.<\/p>\n
It\u2019s where you can allow SSH authentication, too.<\/p>\n
In this example, I\u2019m going to show you how to get SSH quickly set up in our Hub 2.0.<\/p>\n
Then, I\u2019ll provide a link to an article of ours that has a ton <\/strong>of very useful and detailed information that shows how to login to a cloud server, generate a public and private key pair, commands, and everything you need to know for SSH.<\/p>\n
Note: If you are not hosting with us, your hosting service should have an admin section where you can upload the public key.<\/p>\n
Every hosting service is a bit different, so you may need to reach out to them for assistance.<\/p>\n
Ok, back to The Hub…<\/p>\n
When you\u2019re logged into the Hub, select your website and then click on the Hosting<\/strong> tab.<\/p>\n
![\"The](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/hub-hosting-tab.png\")
Where the hosting tab is in the Hub.<\/figcaption><\/figure>\n Once you click the Hosting tab, more options will appear.<\/p>\n
From this point, click on the SFTP\/SSH<\/strong> tab.<\/p>\n
\n![\"STFP\/SSH](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/ssh-tab-the-hub.png\")
<\/div>\nThis takes you to a screen where you can view your SFTP\/SSH Accounts<\/strong> and Users<\/strong>.<\/p>\n
![\"All](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/SSH-accounts-and-users.png\")
All your SSH accounts and users.<\/figcaption><\/figure>\n For this post, we’re interested in SSH. For a detailed tutorial on using SFTP, see this post on using SFTP to transfer your files securely<\/a>.<\/p>\n
Setting up a new user with an SSH account is quick and easy to do.<\/p>\n
First, click on Add User<\/strong>.<\/p>\n
![\"Add](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/add-ssh-user.png\")
Add a new SSH user.<\/figcaption><\/figure>\n This will give you two options: SFTP User <\/strong>or SSH User<\/strong>.<\/p>\n
![\"SSH](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/new-ssh-user.png\")
We\u2019ll go with SSH…<\/figcaption><\/figure>\n Clicking on SSH User will take you to an area where you fill out specific information for a new user.<\/p>\n
\n![\"New](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/new-ssh-user-setup.png\")
<\/div>\n<\/div>\n\nCreate a Username <\/strong>and Password<\/strong> (or use the funky password we’ll automatically generate for you).<\/p>\n
Next up is Path Restriction<\/strong>. If you like, you can limit the user’s access to your entire wp-content <\/strong>directory, or just to your Plugins<\/strong>, Themes, and Uploads<\/strong> folder.<\/p>\n
If you want no restrictions, just keep it on the default of None<\/strong>.<\/p>\n
You can also choose the Environment <\/strong>(i.e. Production<\/strong> or Staging<\/strong>).<\/p>\n
When you have all of the necessary information inputted, click the blue Add <\/strong>button.<\/p>\n
That\u2019s it!<\/em><\/p>\n
The new user will now appear in the dashboard. He or she will use the information to log into SSH to work on your site with commands<\/a> and more.<\/p>\n
You can edit the user, password, restrictions, and environment for any user at any time.<\/p>\n
There\u2019s a ton you can do with SSH and it\u2019s easy to get started. For more detailed information, please check out our article all about SSH<\/a>.<\/p>\n
And now that you know about SSH…<\/p>\n
<\/a>What is SSL?<\/strong><\/h2>\n
You may not be aware of this, but you\u2019re probably already familiar with it and what it’s evolved to.<\/p>\n
For example, have you ever logged into your checking account or another website (e.g. one about Bahama vacations) and noticed it starts with \u201chttps:\/\/\u201d instead of just \u201chttp\u201d? There\u2019s an \u201cs\u201d. Hmm…<\/p>\n
Or, for an even quicker example, check out the lock to this post here on WPMU DEV from my browser.<\/p>\n
You\u2019ll notice in the address bar, we have a lock before our URL. I told you that you were already familiar with it ;)<\/p>\n
\n\n![\"SSL](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/wpmu-dev-ssl-certificate.png\")
Look familiar?<\/figcaption><\/figure>\n SSL<\/strong><\/a> (secure socket layer) was the standard security technology for establishing an encrypted link between a server and a browser until 2011 when TLS took over.<\/p>\n
This link ensures that all data that is passed between the web server and browser stay private.<\/p>\n
When you visit a website that has a form and you fill out your information, SSL helps keep it secured<\/a>. If you did this on an unsecured website, that information could be intercepted by (yikes) hackers.<\/p>\n
It\u2019s often used for user account pages, online checkout, and any site where important or sensitive information is used.<\/p>\n
With SSL, your browser will form a connection with the server, look around for an SSL certificate, and then connect together with your browser and the server.<\/p>\n
The connection is secure so that only you and the site that you submitted the information can access or see what you input in your browser.<\/p>\n
The connection is instant and is typically faster than an unsecured website. If you have a website with SSL, you\u2019ll score much better with SEO as well as security.<\/p>\n
<\/a>Why Do We Use It?<\/strong><\/h3>\n
Simply put…to stay secure!<\/p>\n
It\u2019s important that information doesn\u2019t get into the wrong hands and you feel at ease when transmitting personal information online.<\/p>\n
Otherwise, some crook might take that money you were going to use on vacation and go on one himself.<\/p>\n
<\/a>What\u2019s the Importance of It?<\/strong><\/h3>\n
It\u2019s important to keep information safe when online.<\/p>\n
With SSL, sensitive information is sent across the Internet encrypted. That means only the intended receiver can access it.<\/p>\n
Also, an SSL certificate provides authentication. This ensures that you\u2019re sending the information to the right place and not some hacker who is trying to swipe your information.<\/p>\n
SSL providers are important to help verify a company. They use several identity checks to make certain that the website is who they say they are.<\/p>\n
<\/a>Authentication Process<\/strong><\/h3>\n
A browser or a server will attempt to connect to a website with SSL. The browser then asks (requests) that the web server identifies itself.<\/p>\n
The web server will then send the browser (or server) a copy of its SSL certificate.<\/p>\n
The browser checks it out to make sure it can trust it. If it can, it sends a message to the webserver.<\/p>\n
From here, the webserver sends back an acknowledgment that\u2019s digitally signed. This starts an SSL encrypted session.<\/p>\n
Data between the browser\/server and the secure SSL server is shared securely because it\u2019s encrypted.<\/p>\n
![\"How](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/SSH_v_SSL_2-1.png\")
How SSL works.<\/figcaption><\/figure>\n <\/a>Getting Set Up in the Hub<\/strong><\/h3>\n
This is extremely easy to set up because, well, it\u2019s already done for you!<\/strong><\/p>\n
All websites that are hosted with WPMU DEV are provided with SSL certificates.<\/p>\n
Considering how unsafe unsecured sites are, it\u2019s essential for us to provide members with this automatically.<\/p>\n
You can see the SSL status of your site by clicking on your website\u2019s URL, then Hosting<\/strong>>Domains<\/strong>.<\/p>\n
![\"Where](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/SSL-Status.png\")
Where you can see your SSL status.<\/figcaption><\/figure>\n It will have a green checkmark underneath SSL status if all is running well.<\/p>\n
Keep in mind that when you add a site, it may take several minutes for a certificate to be ready.<\/p>\n
Sometimes the process can take hours or, in very rare cases, an entire day. It just depends on how fast your DNS settings propagate.<\/p>\n
Our SSL certificates<\/a> come from Let\u2019s Encrypt<\/a>. It\u2019s totally free for you and we renew them every three months.<\/p>\n
<\/a>Custom SSL Certificates<\/strong><\/h3>\n
Adding a custom SSL is an option for you as well with our hosting.<\/p>\n
The first thing you\u2019ll need to do is submit a Certificate Signing Request (CSR)<\/strong> to a Certificate Authority<\/strong>. Certificate providers (e.g. CSR Generator<\/a>) usually have tools or can assist you in generating the CSR.<\/p>\n
When you obtain the CSR, it\u2019s important to save a copy of the Private Key<\/strong>.<\/p>\n
Now, you\u2019ll use the CSR to purchase the SSL certificate<\/strong><\/a>. This will give you a Private Key<\/strong>, Certificate<\/strong>, and Certificate Chain<\/strong>.<\/p>\n
Your SSL provider should be able to provide you with this information if they create a CSR with their interface.<\/p>\n
Keep in mind, you can use wildcard SSL<\/a> certificates, too.<\/p>\n
Our team can upload those for you exactly like non-wildcard certificates.<\/p>\n
Also, our support staff can help with adding custom certificates. You can start a live chat or create a support ticket. Either way, we\u2019ll get you all set up.<\/p>\n
To learn more about SSL, be sure to check out our article How to Use SSL and HTTPS with WordPress.<\/a><\/p>\n
<\/a>A Little Bit on TLS<\/strong><\/h2>\n
Whenever you see SSL being mentioned, you\u2019ll often see TLS, too.<\/p>\n
So, what\u2019s TLS?<\/p>\n
TLS (Transport Layer Security)<\/strong> is the standard security protocol that is designed to facilitate privacy and data security over the Internet.<\/p>\n
It encrypts the information that is being communicated between web applications and servers (e.g. web browsers loading a website).<\/p>\n
You often see the name SSL\/TLS used interchangeably. TLS is basically an upgraded version of SSL. However, there are a few minor distinctions.<\/p>\n
Here are five of them:<\/p>\n
- \n
- Alerts:<\/strong> TLS protocol is to remove the alert message. It replaces it with several other alert messages. Meanwhile, SSL has a No Certificate <\/strong>alert message.<\/li>\n
- Cipher Suites:<\/strong> TLS doesn\u2019t offer any support for Fortezza cipher suite<\/a>, however, SSL does. TLS follows an improved standardization process that helps make defining of new cipher suites simpler (e.g. RC4<\/a>).<\/li>\n
- Handshake:<\/strong> With SSL, the hash calculation additionally encompasses the master secret and pad. With TLS, the hashes are calculated over the handshake message.<\/li>\n
- Record Protocol:<\/strong> TLS uses HMAC<\/a>, which is a hash-based message authentication code. It\u2019s used after each message encryption. SSL uses Message Authentication Code (MAC<\/a>) after encrypting each message.<\/li>\n
- Message Authentication<\/strong>: TLS depends on HMAC Hash-based Message Authentication Code while SSL authenticates by adjoining the key details and application data in an ad-hoc way.<\/li>\n<\/ol>\n
As you can see, they\u2019re different but are also very similar in nature.<\/p>\n
You also now know why you often see SSH\/TLS together. TLS fixes some of the security vulnerabilities in the earlier SSL protocols.<\/p>\n
Something to remember is that your certificate is not exactly the same as the protocol that your server will use. That means you do not need to change your certificate to use TLS.<\/p>\n
Sure, it may be labeled as an SSL certificate, but your certificate already supports both the SSL and TLS protocols.<\/p>\n
If you\u2019d like to check out what version of SSL\/TLS your web browser is using, you can cruise over to the How\u2019s My SSL<\/a> tool. It\u2019ll show you instantly.<\/p>\n
TLS is going to become more and more common of a term than SSL soon, so get used to it. After all, TLS is the standard.<\/p>\n
<\/a>Differences Between SSH and SSL\/TLS<\/strong><\/h2>\n
Now that we\u2019ve looked at SSH and SSL\/TLS — what are the similarities and differences?<\/p>\n
I\u2019ve gone over how they function and what they do, however, the big takeaway is they both use encryption to protect data that is being passed between two network devices.<\/p>\n
Here\u2019s a quick breakdown of some of the essential differences between the two:<\/p>\n
![\"SSH](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/05\/Comparison_Table_SSH_SSL.png\")
SSH vs SSL\/TLS<\/figcaption><\/figure>\n While we are comparing security protocols and acronyms that start with “s,” the other protocol you should know about is when to use SSH<\/strong> vs SFTP<\/strong>.<\/p>\n
This is important if you plan to access files on your hosting server securely. Fortunately, we have written an entire article about it here: What is SFTP? How to Transfer Your Files Securely<\/a>.<\/p>\n
<\/a>Feel Secure Yet?<\/strong><\/h2>\n
Security has many layers and differences, as you can see. A strong password isn\u2019t the only thing that\u2019s going to protect you.<\/p>\n
Both SSH and SSL have their unique purposes and do what they can to help.<\/p>\n
SSL is the primary requisite of security on the web, SSH is an added safety feature of it. When you add TLS into the mix, all three of them render strong and mighty security and safer communication in the web hosting process.<\/p>\n
SSH does have some additional features, such as providing multiple data channels to its applications.<\/p>\n
It supports the execution of remote programming, TCP connections, and more, which makes it often used by web hosting companies as the sole security protocol.<\/p>\n
However, when implemented correctly, they all work well to help keep your information secure.<\/p>\n
Throw some good hosting<\/a> and take other measures (e.g. install our Defender plugin<\/a>), and you\u2019ll have a knockout system of security for the web.<\/p>\n
And now the big difference between SSH and SSL is you\u2019re no longer confused by them.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
When it comes to security online, you want to feel good about sending information across the web. SSH and SSL are here to help keep your information secure. So, what\u2019s the difference between the two? It might be easy to confuse them. They both consist of three letters, they both start with two \u2018Ss\u2019, and […]<\/p>\n","protected":false},"author":811449,"featured_media":187645,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"blog_reading_time":"13","wds_primary_category":0,"wds_primary_tutorials_categories":0,"footnotes":""},"categories":[263,11260,11259],"tags":[],"tutorials_categories":[11233],"class_list":["post-187626","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","category-wpmu-dev-products","category-wpmudev-tutorials","tutorials_categories-hosting"],"_links":{"self":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/187626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/users\/811449"}],"replies":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/comments?post=187626"}],"version-history":[{"count":28,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/187626\/revisions"}],"predecessor-version":[{"id":209299,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/187626\/revisions\/209299"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media\/187645"}],"wp:attachment":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media?parent=187626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/categories?post=187626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tags?post=187626"},{"taxonomy":"tutorials_categories","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tutorials_categories?post=187626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Cipher Suites:<\/strong> TLS doesn\u2019t offer any support for Fortezza cipher suite<\/a>, however, SSL does. TLS follows an improved standardization process that helps make defining of new cipher suites simpler (e.g. RC4<\/a>).<\/li>\n
- Authentication Process<\/a><\/li>\n
- Why do we use it?<\/a><\/li>\n