Irish Rail Smartcard website and security

[markpb]

Originally Posted by Thomas Ralph

That would require a new SSL certificate.

It's not hard to terminate the SSL connection on one machine and then direct one URL to the IIS server and another to the Apache server. It's fully acceptable to do that under PCI-DSS rules. There's no reason for Irish Rail to adopt the approach they've taken other than laziness.