SSL compliance

What is SSL?

SSL (Secure Sockets Layer) is the standard security technology that establishes an encrypted link between a web server and a client in order to ensure that all data passed between them is private and integral.
Most publishers and programmatic ad exchanges are currently transitioning to secure connections and transactions. This means that not only the Ad Server but also the Ad itself and all the resources that it loads, need to use an SSL connection.

Apple has in turn introduced ATS (App Transport Security), which enables data transfer over HTTPS rather than HTTP connections. This increases the safety in data transfer and preventing eavesdropping of content.

What I need to do to continue to run my campaigns as planned?

To prevent Ads from not performing as expected because of their serving non-secure creatives, Bucksense recommends that all customers move their ad serving resources to secure connections in order to ensure SSL compliancy.
All URLs that link to external resources and components of ads, including creatives (Ad Tags and Vast Video) and tracking, must be able to serve via SSL (https://) since any unsafe connections might be refused or ignored by the Exchanges.

Find below some recommendations about how to manage creatives in Bucksense console avoiding issues with SSL.

Ad Tag:

  • every time you upload a new Ad Tag, make sure to set HTTPS secure ON
  • make sure that all items included in and called by the ADTAG are served over a secure connection (ie. external javascript images and css)
  • if using an HTML/JavaScript Ad Tag, make sure that all files uploaded (JPEG, GIF etc) are HTTPS secure
  • none of the single items can be in HTTP since this can stop the Ad Tag from being loaded

1

VAST:

  • every time you upload a new VAST (both VAST TAG url and VAST xml), make sure to set HTTPS secure ON
  • check with your Ad Server that all the videos and tracking events included in your VAST are using HTTPS connection (3rd parties can’t include non SSL Urls)

2

Take a look at some of the most common general issues with SSL and the related necessary actions.

ISSUE: mixed secure-non secure content (e.g. 3rd party HTTP tracker in a HTTPS creative)
ACTION: ensure that all the 3rd parties are using only SSL urls

ISSUE: SSL protocol not supported by current browsers or Operating System
ACTION: check if your servers (including 3rd parties) support TLS1.2

ISSUE: SSL ciphers not supported by current browser or Operating System
ACTION: make sure that SHA-2 is included in the available ciphers list on your servers (and 3rd parties)

ISSUE: wrong Domain on certificate
ACTION: make sure that all the urls are using the domain name listed in the certificate

ISSUE: untrusted certificates
ACTION: check that all your certificates are issued by a trusted Certification Authority