paranoid and anxious learning something new.

[prot]

Firstly thanks for what looks to be a great product!

My info,

osCommerce 2.2-MS2

PHP Version 4.2.3

hosted by 1&1.

I've read through the install guides, and searched through the forums, and I think I have a handle on the two config files. After some tweaking here and there I think I even have my ssl setup right.

But I'm a little bit paranoid and anxious as I'm learning something new. If some one could take the time to read the rest of this post, and put my mind at ease, I'd be a truly happy camper.

Onward...

The install went very smooth. Impressive! After making the required chmod's, I pointed my browser at the /install dir and filled in the blanks. Everyting was successfull.

A couple of things I noticed after chmoding again was a prob with my SSL cert. the names not matching etc.

Closer inspection I saw that the 2 config files were missing the www.

So I took a brave pill and changed them.

catalog config
define('HTTP_SERVER', 'http://www.tropicalstitches.com');
define('HTTPS_SERVER', 'https://www.tropicalstitches.com');
define('ENABLE_SSL', true); // secure webserver for checkout procedure?

Seems to be fine, & no more warnings that the cert names don't match.


The other thing that I noticed was when I went into admin, I would start off in ssl, but if I clicked on a link I would go back to regular http.

Poping another brave pill, I made changes adding the www's and changing all the http to https

catalog admin config

define('HTTP_SERVER', 'https://www.tropicalstitches.com');
define('HTTP_CATALOG_SERVER', 'https://www.tropicalstitches.com');
define('HTTPS_CATALOG_SERVER', 'https://www.tropicalstitches.com');
define('ENABLE_SSL_CATALOG', 'true');

Seems to have fixed it.

Is all this ok?

One last thing, is there a way to make my admin page go automatically to https

Thanks, and sorry for the long winded question.

[jpf]

Mostly - Yes.

Does the HTTPS works? Got your OWN cert and installed? If you have the basic 1&1 package you HAVE to use THERE SHARED certificate with NO option of installing your own.

To make ADMIN ALLWAYS HTTPS - then change the admin's configure.php file HTTP_SERVER to the secure server (like you have already done...)

Also HTTP_CATALOG_SERVER is normally http://.... not https://.... not that it maters - just forces it from the admin side to look at the secure version first....

Also you may have to edit on your server - PHP.INI and set:
register_globals = On

Good Luck!

[prot]

Thanks.

Yes HTTPS is working, I went ahead and bought my own cert through 1&1 and geotrust I was able to get one for $40.

What do you mean by,

Also you may have to edit on your server - PHP.INI and set:
register_globals = On

?

[jpf]

If your not getting warning/errors about Register Globals - then I would not worry. However if you do, then SOMEWHERE in your server there is a PHP.INI file that you can edit and change that to be on. If not ask 1&1 to set it. I know they can cause I asked this a while ago and they said they support this being on or off.

Other than that - does 1&1 work fine for you?

[prot]

Yes, so far 1and1 has been good. Their phone tech support has been very helpfull. It was a little hard ajusting to having three domains under one account, the way they do it, and it would be nice to be able to change some of the user names etc.

Otherwise, I'm very happy with them.