Home/ ProPay WEB/ SSL Certificate Setup

SSL Certificate Setup

SSL (Secure Sockets Layer) certificates encrypt communication between clients and your ProPay WEB server, protecting sensitive payroll data during transmission. This guide explains how to obtain and install SSL certificates for ProPay WEB.

Understanding SSL Certificates

What is SSL?

SSL encrypts data transmitted between a web browser and web server. When enabled:

  • All data traveling across the internet is encrypted
  • Passwords cannot be intercepted
  • Payroll information remains confidential
  • Browsers display a padlock icon showing the connection is secure
  • URLs start with HTTPS instead of HTTP

Why Use SSL for ProPay WEB?

Security Benefits

  • Encrypts usernames and passwords during login
  • Protects employee Social Security numbers
  • Secures wage and salary information
  • Prevents data interception by third parties

Professional Benefits

  • Shows clients you take security seriously
  • Builds trust and confidence
  • Meets modern security standards
  • Required for many compliance requirements

Browser Benefits

  • Modern browsers warn users about non-HTTPS sites
  • Browsers may block login forms on non-HTTPS sites
  • HTTPS is becoming the expected standard for all websites

> Important: While SSL is optional for ProPay WEB, it is strongly recommended for any system handling sensitive payroll data.

Types of SSL Certificates

Domain Validated (DV) Certificates

Description: Basic SSL certificate verifying you control the domain name.

Best for: Small payroll processors, basic security needs

Cost: $10-50 per year or free (Let's Encrypt)

Validation time: Minutes to hours

Pros:

  • Low cost or free
  • Quick issuance
  • Easy to obtain

Cons:

  • Minimal identity verification
  • Basic trust indicators
  • Not suitable for e-commerce

Organization Validated (OV) Certificates

Description: Certificate verifying your organization's identity and legitimacy.

Best for: Established payroll processors, professional image

Cost: $50-200 per year

Validation time: 1-3 business days

Pros:

  • Organization name in certificate details
  • Better trust indicators
  • Moderate cost

Cons:

  • Requires business documentation
  • Takes longer to obtain
  • Higher cost than DV

Extended Validation (EV) Certificates

Description: Highest level certificate with extensive organization verification.

Best for: Large payroll processors, maximum trust

Cost: $150-500 per year

Validation time: 3-7 business days

Pros:

  • Organization name in browser address bar (some browsers)
  • Maximum trust indicators
  • Extensive verification

Cons:

  • Highest cost
  • Lengthy verification process
  • Requires extensive documentation

Choosing an SSL Certificate

Recommended Certificate Type

For most ProPay WEB installations, a Domain Validated (DV) certificate provides adequate security at minimal cost.

Consider an Organization Validated (OV) certificate if:

  • You process payroll for many clients
  • Professional image is important
  • Clients expect higher security standards
  • Budget allows for additional investment

Certificate Authorities (CAs)

Purchase SSL certificates from trusted Certificate Authorities:

Popular Commercial CAs:

  • DigiCert - Premium certificates, excellent support
  • Sectigo (Comodo) - Good balance of price and features
  • GoDaddy - Widely available, budget-friendly
  • Namecheap - Competitive pricing
  • SSL.com - Various certificate types

Free Certificate Option:

  • Let's Encrypt - Free DV certificates, 90-day validity, auto-renewal available

Professional SSL Installation Services: If you don't have internal IT support, these services can handle the entire SSL setup:

SSL Installation Guides:

Certificate Requirements

Your SSL certificate should:

  • Match your ProPay WEB domain name exactly
  • Support your server's Windows version and IIS version
  • Come with intermediate certificates for full trust chain
  • Be valid for at least one year

Obtaining an SSL Certificate

Step 1: Generate Certificate Signing Request (CSR)

Before purchasing a certificate, generate a CSR from your server:

  1. On the server, open Internet Information Services (IIS) Manager
  2. Click your server name in the left panel
  3. Double-click Server Certificates in the center panel
  4. Click Create Certificate Request in the right panel
  5. Enter your information:
    • Common Name: Your domain (e.g., online.yourpayroll.com)
    • Organization: Your company legal name
    • Organizational Unit: Department (e.g., IT)
    • City/Locality: Your city
    • State/Province: Your state (full name, not abbreviation)
    • Country/Region: US
    1. Click Next
    2. Select cryptographic service provider:
      • Cryptographic service provider: Microsoft RSA SChannel
      • Bit length: 2048
      1. Click Next
      2. Choose a file location to save the CSR (e.g., C:\cert-request.txt)
      3. Click Finish

      Step 2: Purchase SSL Certificate

      1. Visit your chosen Certificate Authority's website
      2. Select the certificate type you want
      3. Add to cart and proceed to checkout
      4. When prompted, paste the contents of your CSR file (cert-request.txt)
      5. Complete the purchase

      Step 3: Complete Domain Validation

      For DV certificates, the CA will verify you control the domain:

      Email Validation:

      1. CA sends email to [email protected] or [email protected]
      2. Click the validation link in the email
      3. Follow instructions to confirm

      File-Based Validation:

      1. CA provides a file to upload
      2. Upload file to your website's root directory
      3. CA verifies file is accessible

      DNS Validation:

      1. CA provides a DNS TXT record
      2. Add the record to your domain's DNS settings
      3. CA verifies the record exists

      Step 4: Download Certificate Files

      After validation, the CA provides your certificate:

      1. Log into the CA's website
      2. Download your certificate files
      3. You should receive:
        • Your certificate file (.cer or .crt)
        • Intermediate certificate(s) (.cer or .crt)
        • Sometimes a CA bundle file

        Save all files to a secure location on your server.

        Installing SSL Certificate in IIS

        Complete Certificate Request

        1. Open IIS Manager
        2. Click your server name
        3. Double-click Server Certificates
        4. Click Complete Certificate Request in right panel
        5. Browse to your certificate file (.cer or .crt)
        6. Enter a friendly name (e.g., "ProPay WEB SSL 2024")
        7. Select certificate store: Web Hosting
        8. Click OK

        Your certificate now appears in the Server Certificates list.

        Install Intermediate Certificates

        If your CA provided intermediate certificates:

        1. Double-click each intermediate certificate file
        2. Click Install Certificate
        3. Select Local Machine as store location
        4. Click Next
        5. Select Place all certificates in the following store
        6. Click Browse
        7. Select Intermediate Certification Authorities
        8. Click OK, then Next, then Finish

        Bind Certificate to Website

        1. In IIS Manager, expand Sites in left panel
        2. Right-click your ProPay WEB website
        3. Select Edit Bindings
        4. Click Add
        5. Configure the binding:
          • Type: https
          • IP Address: Your server's IP or "All Unassigned"
          • Port: 443
          • SSL Certificate: Select your certificate from dropdown
          1. Click OK
          2. Click Close

          Your website now supports HTTPS connections.

          Test HTTPS Access

          1. Open a web browser
          2. Go to `https://yourdomain.com` (note HTTPS)
          3. Verify you see the padlock icon
          4. Click the padlock to view certificate details
          5. Confirm the certificate is valid and matches your domain

          Configure Port Forwarding for HTTPS

          If you're behind a router, add port forwarding for HTTPS:

          1. Access your router configuration
          2. Find port forwarding section
          3. Add a new rule:
            • Service Name: ProPay WEB HTTPS
            • External Port: 443
            • Internal IP: Your server's internal IP
            • Internal Port: 443
            • Protocol: TCP
            1. Enable the rule and save

            Update Windows Firewall

            Allow HTTPS through Windows Firewall:

            1. Open Windows Firewall
            2. Click Allow an app or feature through Windows Firewall
            3. Check Secure World Wide Web Services (HTTPS)
            4. Ensure both Private and Public are checked
            5. Click OK

            Redirect HTTP to HTTPS

            Force all users to use the secure HTTPS connection:

            Method 1: IIS URL Rewrite (Recommended)

            1. Install URL Rewrite Module for IIS (download from Microsoft)
            2. In IIS Manager, select your website
            3. Double-click URL Rewrite
            4. Click Add Rule(s) in right panel
            5. Select Blank rule under Inbound Rules
            6. Configure the rule:
              • Name: HTTP to HTTPS Redirect
              • Match URL:
              • Requested URL: Matches the Pattern
              • Using: Regular Expressions
              • Pattern: (.*)
              • Conditions:
              • Click Add
              • Condition input: {HTTPS}
              • Check if input string: Matches the Pattern
              • Pattern: ^OFF$
              • Action:
              • Action type: Redirect
              • Redirect URL: https://{HTTP_HOST}/{R:1}
              • Redirect type: Permanent (301)
              1. Click Apply

              Now all HTTP requests automatically redirect to HTTPS.

              Method 2: IIS Require SSL

              1. In IIS Manager, select your website
              2. Double-click SSL Settings
              3. Check Require SSL
              4. Click Apply

              This blocks HTTP access but doesn't redirect - users must type HTTPS manually.

              Using Free SSL with Let's Encrypt

              Let's Encrypt provides free DV certificates with 90-day validity and automatic renewal.

              Install Certify The Web

              Certify The Web is a free Windows application that automates Let's Encrypt:

              1. Download Certify The Web from https://certifytheweb.com
              2. Install on your server
              3. Launch the application
              4. Click New Certificate
              5. Select your IIS website from dropdown
              6. Enter your email address
              7. Accept Let's Encrypt terms
              8. Click Request Certificate
              9. Wait for validation and issuance (usually 1-2 minutes)
              10. Certificate automatically installs in IIS

              Enable Auto-Renewal

              1. In Certify The Web, select your certificate
              2. Click Preview tab
              3. Verify renewal test succeeds
              4. The application automatically renews certificates before expiration

              Certificate Maintenance

              Monitor Certificate Expiration

              Set calendar reminders for:

              • 30 days before expiration - Begin renewal process
              • 14 days before expiration - Complete renewal
              • 7 days before expiration - Final warning

              Renew Certificates

              For commercial certificates:

              1. Generate new CSR (follow Step 1 from obtaining certificate)
              2. Submit CSR to CA for renewal
              3. Complete validation
              4. Install renewed certificate
              5. Update binding if necessary

              For Let's Encrypt:

              • Renewal is automatic with Certify The Web
              • Verify auto-renewal works by checking logs

              Update After Domain Changes

              If you change domain names:

              1. Obtain new certificate for new domain
              2. Install new certificate
              3. Update website binding
              4. Test access with new domain
              5. Keep old certificate active during transition

              Troubleshooting

              Certificate Warning in Browser

              Problem: Browser shows "Your connection is not private" warning.

              Causes:

              • Certificate doesn't match domain name
              • Certificate is expired
              • Intermediate certificates not installed
              • Self-signed certificate (not trusted)

              Solutions:

              • Verify certificate Common Name matches your domain exactly
              • Check expiration date
              • Install intermediate certificates
              • Use certificate from trusted CA

              HTTPS Site Not Loading

              Problem: Cannot access site via HTTPS.

              Causes:

              • Port 443 not open in router
              • Port 443 blocked by Windows Firewall
              • Certificate binding incorrect
              • IIS not listening on port 443

              Solutions:

              • Verify port forwarding for port 443
              • Check Windows Firewall allows HTTPS
              • Review website bindings in IIS
              • Restart IIS

              Mixed Content Warnings

              Problem: Page loads but shows "not secure" with mixed content warning.

              Cause: Page loads resources (images, scripts) via HTTP instead of HTTPS.

              Solution:

              • Update ProPay WEB code to use HTTPS URLs
              • Or use protocol-relative URLs (//domain.com/resource)
              • Contact Paysoft support for assistance

              Certificate Installation Fails

              Problem: Cannot complete certificate request in IIS.

              Causes:

              • Certificate file format incorrect
              • CSR and certificate don't match
              • IIS doesn't have permissions

              Solutions:

              • Verify you're using the correct certificate file
              • Ensure certificate matches the CSR you generated
              • Run IIS Manager as administrator
              • Contact CA for correct file format

              Security Best Practices

              Use Strong SSL Protocols

              1. In IIS Manager, select your server
              2. Open Registry Editor
              3. Go to: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols`
              4. Disable older protocols (SSL 2.0, SSL 3.0, TLS 1.0)
              5. Enable modern protocols (TLS 1.2, TLS 1.3)

              Or use a tool like IIS Crypto to configure SSL settings safely.

              Enable HSTS

              HTTP Strict Transport Security forces browsers to always use HTTPS:

              1. In IIS Manager, select your site
              2. Double-click HTTP Response Headers
              3. Click Add in right panel
              4. Add header:
                • Name: Strict-Transport-Security
                • Value: max-age=31536000; includeSubDomains
                1. Click OK

                Disable Weak Ciphers

                Use only strong encryption ciphers:

                1. Download and run IIS Crypto tool
                2. Select Best Practices template
                3. Apply settings
                4. Restart server

                Test SSL Configuration

                Verify your SSL setup is secure:

                1. Visit https://www.ssllabs.com/ssltest/
                2. Enter your domain
                3. Run the test
                4. Review results and address any issues
                5. Aim for an A or A+ grade

                Related Topics

                ← Back to Index