如果使用安全网络服务，我是否需要 SSL 证书？
我正在使用第三方网络服务。为了让我的用户能够访问他们的第三方帐户，他们需要登录。我为他们提供了从我的网站登录第三方网站的界面。我的问题是，如果网络服务已经提供了 SSL 证书，我还需要 SSL 证书吗？ Web 服务有一个特殊的 Login 方法，它使用 https 协议。这是否意味着我的网站不需要 SSL 证书，或者我必须为我的网站购买 SSL 证书？
谢谢
I'm using a third party web service. In order for my users to be able to access their third party account, they need to log in. I provide the interface for them to log in to the third party site from my site. My question is, do I need a SSL certificate if the webservice already provides one? The webservice has a special Login method, which uses the https protocol. Does this mean that I don't need one for my site, or will I have to purchase a SSL certificate for my site?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为你需要更多地解释一下你在做什么。
您是否使用 iframe 或重定向以便第三方站点可以进行身份验证？如果是这样，那么您可能没问题，不需要自己的证书。
另一方面，如果用户向您的站点发出包含其凭据的 HTTP 请求，那么您就会遇到问题。 从技术上来说，您不需要为此使用 SSL，但这是一种不好的行为。如果您要接受某些第三方的用户凭据，您至少应该尝试匹配第三方的安全级别。
I think you need to explain a bit more about what you are doing.
Are you using iframes or redirects so that the third party site can do the authentication? If so, then you're probably fine and don't need your own certificate.
If, on the other hand, the user is making HTTP requests to your site that contain their credentials then you've got a problem. Technically speaking, you don't need to use SSL for this, but it's kind of bad behavior. If you're going to accept user credentials for some third party you should at least try to match the third-party's level of security.
由于您的用户通过您的网站登录并将向您的 Web 应用程序提供他们的凭据，因此您应该尽力保护他们。因此，您应该在您的站点上启用 SSL 并获取证书。
也就是说，如果您不关心安全性，那么无需 SSL/证书也可以工作。
Because your users log in through your site and will provide their credentials to your web application, you should attempt to protect them as well as you can. So you should enable SSL on your site and get a certificate.
That said, if you don't care about security, then it would also work without an SSL/certificate.