I need to build a small web app that will ultimately need to be launched via SSL.
My question is, can I design and test it as if it was an ordinary application and only later add whatever is necessary to make it secure ? Or I have to test it over SSL right from the start.
You’ll be fine waiting on the SSL while you develop your app. Be careful not to hard-code any
http://urls, and I don’t think you’ll run into any problems for the bulk of your development. Just make sure you do plenty of testing after making the switch to the SSL before going live.