SSL is broken

[michael_s]

I am not seeing any security warnings on your site anymore in either IE 6 or Firefox 1.0.2

Looks like you have it figured out.

[midwestwebsites]

Michael,

Actually I didn't figure it out. Sorry I was relying on memory when described the problem. The security warning actually happens when I click checkout, and then login to my account when it takes me to the Payment Information screen (I skip Delivery Info b/c I don't ship physical goods).

Would you like me to PM you a login so you can see the security warning?

Thanks for your help with this.

Jonathan

[michael_s]

I just went through your checkout all the way to the end (even created a test user), and I did not get a security warning at any stage of the process.

[midwestwebsites]

Michael,

In my last post, I had tried to explain the problem was with logging into an account but aparently I wasn't very clear.

I agree there are no security warnings the way you described; however if you log off with the user you created on my site and log back in you will get a security warning.

Could you please try this and see if you know why the security warning takes place when logging into a previously created account?

Thanks
Jonathan

[michael_s]

Yes, I see the warning. That may be because you have changed the normal login process. Normally, when you login, it takes you to your secure account page, not back to the non-secure home page. It looks like that is where your problem is...Change it back to the default function and you will not have this issue.

[midwestwebsites]

Michael,

What method are you using to login? When I login using the "My Account" link it takes me to "My Account Information" page. When I am in the process of checking out but haven't logged in yet, when I login, it takes me to the checkout page. Both pages bring the security warnings, but neither page brings me to the home page.

To my knowledge I never knowingly changed the login process. Can you tell me what I need to do to fix this?

Thanks

Jonathan

[michael_s]

I suggest this for debugging:

Check your sessions settings. How are they set in the admin? Are you storing them as files in the database? I am only guessing, as I have not ever seen this before.

If you did not change the code, it has to be a configuration/settings issue or a server congfig issue. Of course, I am not familiar with 1&1's setup, so I cannot help there. As for osCMax, play with the sessions settings and see what you can do...

[midwestwebsites]

Michael,

When I setup the cart I decided to use database storage of the sessions as opposed to file based. I'd be happy to play with the settings; however I don't understand how that relates to my security warning so I'm afraid the best I could do would be hit or miss.

Here are the settings I am using (I tried doing a search on settings but it seems like most people are posting about shared ssl not dedicated. Also there was nothing said about sessions in the OSCMAX Administration Guide):

Session Directory: /tmp (I do not know where on FTP this folder is supposed to be located. I don't see it in the catalog folder)
Force Cookie Use: False
Check SSL Session ID: False
Check User Agent: False
Check IP Address: False
Prevent Spider Sessions: True
Recreate Session: True

Thanks
Jonathan

[michael_s]

There are only a few settings. Turn on Force Cookie and turn off Recreate Session and see what happens.

[midwestwebsites]

I turned Force Cookie On and turned off Recreate Sessions but the same problem happened so I put the settings back the way they were.

Any other thoughts?

Thanks
Jonathan