Just Enough to Be Dangerous

TECHNICAL REFERENCE

SSL/TLS for Car Dealerships: A Technical Reference

How HTTPS secures a connectionYour browserthe shopperYour serverthe dealer’sHello + supported encryptionCertificate + public keyVerify certificate, exchange keysEncrypted sessionThe certificate proves the server is really you.

1. What “SSL” actually means today

SSL (Secure Sockets Layer) was the original protocol, deprecated in 2015 due to vulnerabilities (POODLE, BEAST, etc.). TLS (Transport Layer Security) is the successor. TLS 1.3 (RFC 8446) is the current standard. The industry still uses “SSL” colloquially; what you actually deploy is TLS.

The job:

  • Encryption — confidentiality of data in transit.
  • Authentication — the server is who it claims to be, verified by a trusted Certificate Authority (CA).
  • Integrity — the data wasn’t tampered with in transit.

2. The handshake (TLS 1.3, simplified)

  1. ClientHello. Browser sends supported cipher suites, key share, and SNI (Server Name Indication) — the hostname it’s trying to reach.
  2. ServerHello + certificate. Server selects a cipher suite, sends its certificate, and proves possession of the private key.
  3. Key exchange. With TLS 1.3, the key exchange happens in the first round trip. 0-RTT is possible if the client has previously connected.
  4. Finished. Both sides confirm the handshake. Application data flows.

TLS 1.3 vs. 1.2:

  • 1.3 requires PFS (Perfect Forward Secrecy) via ephemeral key exchange. 1.2 made it optional.
  • 1.3 removed legacy ciphers (RC4, 3DES, MD5, SHA-1, static RSA).
  • 1.3 reduces the handshake to 1-RTT (or 0-RTT with resume), faster than 1.2’s 2-RTT.

If your stack still supports TLS 1.0 or 1.1, you’re out of compliance with most modern browsers and PCI DSS.

3. Certificate types

By validation level:

  • DV (Domain Validated). The CA verifies the requester controls the domain (via DNS record, HTTP file, or email). Cheap, fast, often free (Let’s Encrypt). Most dealership sites use DV.
  • OV (Organization Validated). The CA also verifies the organization’s identity. Takes days, costs more. Visible in some browsers’ cert viewer (organization name shown).
  • EV (Extended Validation). Strictest validation. Used to show a green bar in browsers; most browsers removed the visual indicator years ago. Still useful for high-trust sites. Rare in the dealer space.

By coverage:

  • Single-name. Covers one hostname (e.g., yourdealership.com). Doesn’t cover www.yourdealership.com.
  • SAN (Subject Alternative Name). Covers multiple specific hostnames in one cert.
  • Wildcard. Covers one domain and all its subdomains (*.yourdealership.com). Convenient but expands the blast radius if the private key is compromised.
  • Multi-domain (SAN) wildcard. Combines the above.

4. Certificate authorities dealers actually use

  • Let’s Encrypt — free, automated, 90-day certs, ACME protocol. The default for most modern hosting.
  • DigiCert — commercial, OV/EV, longer validity, used by many enterprise sites.
  • Sectigo (formerly Comodo) — commercial, mixed.
  • Cloudflare — free or paid depending on plan, used when Cloudflare is the CDN.

CAA records let you restrict which CAs can issue certs for your domain. If you only use Let’s Encrypt, publish a CAA record saying so. Any cert issued for your domain by another CA is then a clear signal of mis-issuance.

5. The ACME protocol

ACME (Automatic Certificate Management Environment, RFC 8555) is the protocol behind Let’s Encrypt and most automated cert issuance. The flow:

  1. The ACME client (Certbot, acme.sh, or the host’s built-in) requests a cert for a hostname.
  2. The CA issues an ACME challenge (HTTP-01 for a file at /.well-known/acme-challenge/, DNS-01 for a TXT record at _acme-challenge.yourdomain.com).
  3. The client completes the challenge, proving control of the domain.
  4. The CA issues the cert. The client installs it.
  5. The client schedules renewal before expiration (Let’s Encrypt certs are 90 days; renewal happens at ~60 days).

The DNS-01 challenge is what you use for wildcard certs. The HTTP-01 challenge only works for a single name served over HTTP.

6. Common failure modes at dealerships

Expired certificate. The most common incident. Auto-renew failed because:
– The DNS-01 challenge’s DNS provider didn’t have the right credentials.
– The HTTP-01 challenge’s web server wasn’t serving from the expected path.
– The hostname changed (e.g., a new subdomain was added but no one updated the renewal config).
– The CA rate-limited the request (Let’s Encrypt has rate limits; a misconfigured client that retries aggressively can hit them).

Mixed content. The HTML page loads over HTTPS, but <img>, <script>, <iframe>, or fetch() calls go to HTTP URLs. Browsers block active mixed content (scripts) and warn on passive (images). Common cause: hardcoded HTTP URLs in templates, image hotlinks from an insecure CDN, legacy scripts that pre-date the HTTPS migration.

Fix: CSP (Content Security Policy) upgrade-insecure-requests directive, or a server-side rewrite from HTTP to HTTPS for internal links. Use Mozilla’s Observatory or curl -I to find mixed content.

Wrong hostname. The cert is for yourdealership.com but the customer is on www.yourdealership.com (or vice versa). Either:
– Get a SAN cert covering both.
– Redirect one to the other (typically www to apex or apex to www).
– Use a wildcard for the subdomains you actually use.

Incomplete chain. The cert is valid, but the intermediate CA cert isn’t installed correctly. Some browsers trust the cert, some don’t. Test with SSL Labs’ SSL Server Test.

Revoked cert. Rare in practice (CRL/OCSP stapling issues are more common), but a compromised private key means the cert can be revoked. CRLs and OCSP stapling are the mechanisms.

7. OCSP stapling and Certificate Transparency

OCSP stapling. The server periodically fetches the OCSP response from the CA and “staples” it to the TLS handshake. This avoids the privacy and performance issues of the browser contacting the CA directly. Enable it if your server supports it.

Certificate Transparency (CT). All public CAs log every cert they issue in public CT logs. This means a mis-issuance is detectable. Monitoring services (CertSpotter, Facebook’s CT monitor, crt.sh) can alert when any cert is issued for your domain. Set this up — a cert you didn’t request is a strong signal of a mis-issuance or an attack.

8. HSTS, HPKP, and other hardening

  • HSTS (HTTP Strict Transport Security). A response header that tells browsers to use HTTPS for this domain for max-age seconds. Once a browser sees HSTS, even a typo’d HTTP URL is upgraded. Publish Strict-Transport-Security: max-age=31536000; includeSubDomains; preload and submit to the HSTS preload list.
  • HPKP (HTTP Public Key Pinning). Deprecated, removed from modern browsers. Don’t use.
  • CSP (Content Security Policy). At minimum, upgrade-insecure-requests to fix mixed content. Stronger policies (default-src 'self', specific allowlists) significantly reduce XSS risk.
  • TLS configuration. Use Mozilla’s SSL Configuration Generator. Disable TLS 1.0 and 1.1. Prefer TLS 1.3. Use strong cipher suites only.

9. Internal services and certs

Dealerships also run internal services — dealer management system web UIs, CRM portals, file shares, printers. These often have self-signed certs or default certs from the vendor. The browser warning on these is annoying but not dangerous per se. Better: deploy an internal CA (step-ca, Active Directory CA, Smallstep) and distribute the root to managed devices.

10. The SSL/TLS monitoring checklist

  • [ ] External monitoring on every public hostname, alerting at least 30 days before expiration.
  • [ ] Internal inventory of all certs (issuer, validity, hostname coverage).
  • [ ] CT log monitoring for unexpected issuance.
  • [ ] HSTS enabled with max-age of at least 1 year, includeSubDomains, and preload.
  • [ ] TLS 1.2 and 1.3 only. 1.0 and 1.1 disabled.
  • [ ] OCSP stapling enabled.
  • [ ] CAA records published, restricted to the CAs you use.
  • [ ] Strong cipher suites only (no RC4, 3DES, MD5, SHA-1).
  • [ ] Forward secrecy enabled (ECDHE cipher suites).
  • [ ] SSL Labs scan run quarterly, target grade A or A+.
  • [ ] Mixed content scan (Mozilla Observatory, curl) on every major template.
  • [ ] Documented incident response for an unexpected cert expiration in production.

11. References

  • RFC 8446 — TLS 1.3.
  • RFC 5246 — TLS 1.2 (for historical context).
  • RFC 8555 — ACME.
  • RFC 6797 — HSTS.
  • Mozilla SSL Configuration Generator.
  • Qualys SSL Labs — SSL Server Test, SSL Pulse.
  • Let’s Encrypt documentation and rate limits.
  • Cloudflare’s “Cryptographic Attestation of Identity” papers.
  • IETF TLS working group documents.

Part of the Just Enough to Be Dangerous infrastructure series from VCTRS. Prefer the plain-English version? Read What SSL Actually Means for Your Dealership (And What Happens When It Expires).

Agreement