SSL Certificate for Online Stores
WooCommerce, PrestaShop, OpenCart — Which to Choose?

Why Online Stores Need More Than Free SSL

A basic blog can get away with a free Let's Encrypt certificate. An online store cannot — at least not if it wants to build real customer trust and meet payment compliance requirements. Here is what is at stake:

• Credit card data: Must be encrypted with 256-bit TLS in transit
• Shipping addresses: Personal data that must be protected
• Login credentials: Usernames and passwords must not be interceptable
• Customer trust: 82% of online shoppers say they will not buy from a site without HTTPS
• PCI DSS compliance: Card payment standards mandate HTTPS and TLS 1.2+

PCI DSS and SSL: What You Need to Know

PCI DSS (Payment Card Industry Data Security Standard) is mandated by Visa, Mastercard, and American Express for any business handling card payments. Key SSL-related requirements include:

• All cardholder data must be encrypted in transit
• TLS 1.2 or higher is required (older SSL/TLS versions are prohibited)
• Certificates must be issued by a trusted CA (Certificate Authority)

All SSL certificates sold by AsiaGB — RapidSSL, GeoTrust, and DigiCert — meet PCI DSS requirements as they are issued by CA/Browser Forum members.

Which SSL Type Is Right for Your Online Store?

DV SSL — Best for Small Stores Using Payment Gateways

Domain Validation SSL is issued within 15 minutes and starts at ฿1,000/year. It is sufficient for stores that use a hosted payment gateway (Stripe, 2C2P, Omise, PromptPay) — meaning credit card data never touches your server directly.

OV SSL — Best for Mid-Size Stores That Need Trust Signals

Organization Validation SSL requires CA verification of your business entity. This adds a layer of trust visible in the certificate details — customers can verify they're dealing with a verified company. Starts at ฿4,000/year. Recommended for:

• WooCommerce stores with significant monthly revenue
• Stores selling high-value goods
• Any store wanting to reduce cart abandonment

EV SSL — Best for Enterprise and Direct Card Processing

Extended Validation SSL undergoes the most rigorous vetting and is the highest trust level available. It is the right choice for stores that process card payments directly (without a gateway), banking platforms, and FinTech services. Starts at ฿7,000/year.

SSL Comparison for E-Commerce

Type	Issued In	Price/yr	Best For	PCI DSS
RapidSSL (DV)	15 min	฿1,000	Small stores via gateway	✓
GeoTrust QuickSSL Premium (DV)	15 min	฿3,000	Mid stores, $500K warranty	✓
GeoTrust True BusinessID (OV)	1–3 days	฿4,000	Verified business identity	✓
GeoTrust True BusinessID EV	3–7 business days	฿7,000	Enterprise, direct card processing	✓

WooCommerce SSL Guide

WooCommerce is highly flexible — your SSL needs depend on your payment setup:

• Using a hosted gateway (Stripe, Omise, 2C2P): DV SSL is fully sufficient. Card data never hits your server.
• Wanting to boost trust signals: GeoTrust True BusinessID OV at ฿4,000/year shows verified business info in the certificate.
• Enterprise WooCommerce with direct processing: GeoTrust EV or DigiCert EV.

AsiaGB Hosting customers get free SSL installation — just purchase your certificate and we handle the rest via DirectAdmin.

Wildcard SSL for Multi-Subdomain Stores

If your store architecture spans multiple subdomains — shop., api., admin., cdn. — a Wildcard SSL certificate covers them all for one price. RapidSSL Wildcard at ฿5,000/year is far cheaper than buying individual certificates for each subdomain.

Does SSL Actually Affect Conversion Rate?

Yes, measurably so:

• 75% of online shoppers check for SSL before submitting payment information
• Sites without HTTPS see cart abandonment rates 10–15% higher
• EV SSL displaying the company name has been shown to lift conversions by up to 18%
• Google has used HTTPS as a ranking signal since 2014

How to Verify Your Store's SSL Before Going Live

After installing an SSL certificate, run through this checklist before opening your store to customers. Skipping these steps is one of the most common causes of the "Not Secure" warning appearing even after SSL is installed.

Step 1: Check for Mixed Content Errors

Mixed Content occurs when an HTTPS page loads any resource — image, script, or stylesheet — over HTTP. The browser will display "Not Secure" regardless of your certificate. To find mixed content issues:

# Open Chrome DevTools (F12) and go to the Console tab.
# Look for warnings like:
# "Mixed Content: The page at 'https://...' was loaded over HTTPS,
#  but requested an insecure resource 'http://...'"

For WooCommerce, use the Better Search Replace plugin to update all http:// references to https:// in your database. For PrestaShop, update the shop URL in Administration → Shop Parameters → General.

Step 2: Test with SSL Labs

The free SSL Labs test (ssllabs.com) grades your SSL configuration. Online stores should aim for a grade of A or higher, which confirms:

• TLS 1.2 or 1.3 is in use (TLS 1.0 and 1.1 are disabled)
• No weak cipher suites are enabled on the server
• Your certificate chain is complete and trusted

Step 3: Force HTTPS Redirects

Even with SSL installed, visitors who type your domain without "https://" will land on HTTP unless you redirect them. Add this to your .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

WooCommerce also has a built-in option under Settings → General: Force secure checkout — enable this after your redirect is in place.

The True Cost of SSL vs the Cost of Not Having It

SSL certificate costs look small when compared to the potential damage from not having the right one in place:

Spending ฿1,000–4,000 per year on SSL is one of the highest-return investments you can make for an online store. It directly protects revenue, customer trust, and your search rankings — all three simultaneously.

Multi-Domain SSL for Businesses with Multiple Stores

If your business operates multiple online stores on separate domains — for example, brand-a.com, brand-b.com, and brand-c.com — you have a few options:

• Individual DV certificates per domain — Simplest to manage, each domain renewed separately. Good when stores are run by different teams.
• Wildcard SSL per domain — At ฿5,000/year per domain, covers all subdomains of that domain. Best when each brand has a complex subdomain structure.
• Multi-Domain SSL (SAN certificate) — A single certificate that lists multiple domain names. Efficient for businesses that centralise SSL management. Ask the AsiaGB team for a quote tailored to your setup.

There is no single right answer — the best choice depends on how many domains you have, how they are structured, and whether your team manages them centrally or separately. AsiaGB provides free pre-sales consultation to help you decide.

Summary: How to Choose SSL for Your Online Store

Make your decision by answering three questions:

1. Do you process cards directly or through a gateway? — If through a gateway, DV SSL is sufficient.
2. Do you have multiple subdomains? — If yes, Wildcard SSL at ฿5,000/year covers them all.
3. Do you need enterprise-grade warranty and trust signals? — Choose GeoTrust True BusinessID EV or DigiCert EV.