We have a site at work that is used for the following:
- Our homepage, which is just some info and contact info.
- Job applications are also handled on our site.
There is no place where you can login though.
I told management, seeing that we are a company that does software engineering, it would make a better impression on potential clients if our site had an SSL certificate and if we enforced SSL automatically on anyone's browser that visits the site.
Also, even though we use Google’s business Gmail, we still use the same domain name for our website as we use for email. In other words, user@company.com
and our site is company.com. In other words, potential clients would also get a bad impression if they realised we had no SSL certificate, as they would think that our email server is not sending over TLS.
Should we have an SSL certificate even though no "sensitive" or "important" data that needs to be encrypted will be sent or retrieved from our site?