Computer Geek help needed, SSL questions.

[TheRic]

We need to set up a secure website / web pages so that our clients can register for our annual conference. They would resister on-line, and then pay via credit card. Down the road we probably will be looking into using the secure line for more things.

The web server is on a Windows 2003 Server, IIS 6.0

Been looking into SSL mostly reading MS TechNet, at times I think I understand things. Then the next sentence has me wondering. I think some of the stuff they are talking about is for LARGER companies. Need some help on bringing it all together in my mind, a little hand holding, term explanation, etc.

What I kind of understand:
Need to purchase a certificate from a third party vendor??
Thinking about Verisign??
Do I want a wildcard certificate? If not what kind ( I understand there are many)?

Do I need to create a new website in IIS Manager (I'm thinking so)? Or do I just use web pages that are secure?
If so do I need a new IP number? (I'm thinking not).
If a new website do I copy images/files to this website that I need, or just make the non-secure website a virtual dir, or something else?
Once I have the Cert, I would access this website/section with "https://www.ourname.com"?
Down the road I wouldn't need to create a new website, just add the pages to this section?

Is there any special coding / language needed on the web pages for the secure section / does normal HTML still work. I think it does, co-worker thinks we will need to do this in XML.

Thanks for any and all help!! If you would rather discuss this via PM or Mail that is fine with me. If you need more info, just ask.

[jlm]

I can't help you with the IIS specific questions (I'm a unix guy), but the general ideas behind SSL are the same across platforms, so I can answer some of your questions.

You will need to purchase a certificate from a Certificate Authority, such as Verisign, Thawte, or Digicert. You can generate your own certificates, but users' browsers will throw up a scary-sounding warning if the certificate doesn't come from one of the authorities. Verisign is the "standard", but it'll cost ya. You can save several hundred bucks with a Digicert certificate, as long as you aren't expecting many users to be running, say, Netscape 3.0 or IE 4.0...

A wildcard certificate lets you use the same certificate for any hostname under your top-level domain. So if you have two sites, www1.example.com and www2.example.com, you can use the same wildcard cert for both. A standard certificate will be tied to the full name of the server, and will give you more of those scary-sounding warnings if you try to use it on a server with a different name. It sounds like you don't need the wildcard feature - you're just using www.example.com, and not any other names.

Generally, what you'll need to do is set up a new virtual host on port 443 (the HTTPS port) of your webserver. It will have its own content directories and configuration, separate from the port 80 HTTP server. Any content that would work on your normal web server should work under the HTTPS side - everything's the same, except you've added a layer of encryption, and you'll access it with an https:// URL instead of an http:// one.