SSL Encryption - User Security Query
 

Lets say you have a white label which you are hosting on your own server:

(1) Someone connects to your site (which is 256 bit SSL secured) and you have a REGISTER and LOGIN function that is secured by your SSL.

(2) Once logged in from your site, the user enters into a billing function on a third party site (which is 128 bit SSL secured) with a totally separate key.

How did this work for security of the user?

Since there are two separate levels of encryption and two separate encryption keys for EACH of the two steps (a) login/register and (b) billing/payment does this improve security of the user?

Or is it exactly the same as if you had used one SSL key throughout all steps?

how do you host whitelabel on your server ? never heard of it ...

anyways .,

ssl are domains and or subdomains specific. they are bound to the domains.

lets say, your domain has 256 bit SSL cert, then all the data coming and going from your domain to the surfer unde https protocol will be encrypted using your cert.

when the user enters the billing site aka 3rd party site, the 3rd party site's sssl comes in to play while user is on that domain,

data transferred from your domain 256 bit to 3rd party site 128 bit goes in plaintext but inside this encrypted channel so for anyone who is wiretapping or capturing those packets , it totally useless. but 256 is better than 128.

Do not use SSL 3.0

Use TLS

Make sure the encryption cipher is SHA.

Thanks cartoon... and yes barry the 256bit is TLS/SHA

I think I understand...... however, my question is that does having two separate SSL cert improve security for the user rather than if it was just one SSL certificate used throughout login and billing?

I can only presume that it does since the user is availing 256 bit for the login and a totally separate SSL cert 128 bit for the billing. So therefore if one encryption was decoded, that doesn't necessarily mean the other one will be.

On the same domain it would have no security advantage. Sub domains are separate entities. A wildcarded cert *.domain.tld should be used if a subdomain[s] are used in the process.

Another domain's linked content that is https should not throw a security alert on your domain if it is also served https.