title: SSL Certificate for Delphi Application - Is it required to enable the security?
body: <p>So I've just installed XAMPP today, and I noticed that the index.php had a check to see if it was accessed through HTTPS. Before that, I thought that in order to use SSL security, you need a certificate, but I am in doubt now.</p>
  
  <p>At this point (Please do correct me, that is the whole point of this question!), my own research has led me to believe that the Certificate only provides information about the location you are accessing. If no Cert is found, it is up to the client to determine if he/she trusts the connection.</p>
  
  <p>The XAMPP index page contains this check:</p>
  
  <pre><code>&lt;?php
      if (!empty($_SERVER['HTTPS']) &amp;&amp; ('on' == $_SERVER['HTTPS'])) {
          $uri = 'https://';
      } else {
          $uri = 'http://';
      }
      $uri .= $_SERVER['HTTP_HOST'];
      header('Location: '.$uri.'/xampp/');
      exit;
  ?&gt;
  </code></pre>
  
  <p>Alright, so I access my Localhost through <code>https://localhost</code>, and the Firefox "Do you trust this website?" page appeared (and the question is: Can I trust myself? ;) ). </p>
  
  <p>After that, I created my own little <code>test.php</code>, with the following code:</p>
  
  <pre><code>&lt;?php
    echo "Hi. \n";
    if(isset($_POST['firstname']) &amp;&amp; isset($_POST['lastname']))
    {
     echo "Your Firstname is ".$_POST['firstname']." and your Lastname is ".$_POST['lastname'];
     echo "\r\n\r\n";
      if (!empty($_SERVER['HTTPS']) &amp;&amp; ('on' == $_SERVER['HTTPS'])) {
          echo "You are using SSL, arentcha? :)";
      } else {
          echo "Hmm.. No SSL!";
      }
  
    }
  
  ?&gt;
  </code></pre>
  
  <p>I then created a Delphi application that connects to <code>http://localhost/test.php</code>, and to <code>https://localhost/test.php</code>, aswell as <code>http://jeffijoe.com/test.php</code> and <code>https://jeffijoe.com/test.php</code> with the <code>TIdHTTP</code> control (and for the SSL, I hooked up a <code>TIdSSLIOHandlerSocketOpenSSL</code> to the <code>TIdHTTP</code>'s <code>IOHandler</code> property.</p>
  
  <p>Here is the code for that:</p>
  
  <pre><code>Var
    Src : TStringlist;
    location: String;
  begin
  
  
   if RadioButton1.Checked then
   location := 'localhost' else location := 'jeffijoe.com';
  
   if RadioButton3.Checked then
   Protocol := 'http' else Protocol := 'https';    
  
    Memo1.Clear;
  
    Src := TStringlist.Create;
    try
    Src.Add('firstname=Jeff&amp;lastname=Hansen');
    Memo1.Text := IdHTTP1.Post(Protocol+'://'+location+'/test.php',Src);
    finally
      Src.Free;
    end;
  
  end;
  </code></pre>
  
  <p>Here are the results:</p>
  
  <p><strong>http://localhost/test.php</strong> - Expected output</p>
  
  <p><strong>https://localhost/test.php</strong> - Expected output (It aknowlegdes I am using HTTPS!)</p>
  
  <p><strong>http://jeffijoe.com/test.php</strong> - Expected output</p>
  
  <p><strong>https://jeffijoe.com/test.php</strong> - Fail! 404 Not Found!</p>
  
  <p>My jeffijoe.com is hosted on a regular shared hosting account.</p>
  
  <p>So - the questions are: Was the HTTPS to Localhost truly "secure"? And how come the HTTPS connection to the Jeffijoe.com location failed, when it didnt on my Localhost? How about the Certificates? Are they required? Is it possible to set up the secured connection without having to purchase an overpriced certificate?</p>