https error

[wheelie]

After much mucking about I'm almost ready to give the world a look at my site, but I have a security question that I'm struggling with.

When I log into the admin section on my site, it informs me :

'You are not protected by a secure SSL connection. '

When I set the system up I selected the SSL enable option, but I also have problems with the checkout and account options on the main site. Obviously these two problems are linked together, the question is how do I fix it.

When I go into the checkout option, I get an error telling me that the security certificate is invalid and do I want to accept the one presented to me, even when I say 'Yes' the file does not appear because the https link isn't there.

How do I fix this, is it a problem at the server side, or is it a configuration problem on my side (or both) ??

All help greatly accepted.

wheelie

[jpf]

You need to BUY and setup an SSL certificate. Some host provide a SHARED certificate. But then the URL changes to there SECURE site...

IE: Normal (Un-Secure) site:
http://www.yoursite.com/catalog etc....

Secure (SSL) site:
https://www.yourhostsecuresite.com/~yoursite/catalog etc....

You might have a "self signed" certificate - which is NOT trusted - thus browser complains everytime someon visits your secure site - OR you host has a cerificate installed on that server but it is not for your URL name or is out of date or your IP changed or....a few other reasons....

Ask your hosting about there SSL settings (if shared) or provide (or how to get) the "keys" required to get your OWN SSL certificate (then shop for one...and install it onto your site) for your site.

Good Luck.

(BTW there is 2 differnet files for SSL setting in OSC - one for ADMIN and one for CATALOG - see/edit both of the configure.php files...)

[wheelie]

ok thanks for that. At least I now have a clue where to start looking for this.

[wheelie]

I've still got a problem.

I've installed the security certificate (Note : this is not a shared certificate, but one assigned to www.velvetbox.co.uk), which seemed to work ok. I've checked both the configure.php files and they both have the following setting:

define('HTTPS_SERVER', 'https://www.velvetbox.co.uk');
define('ENABLE_SSL', true); // secure webserver for checkout procedure?

But it still doesn't work. Am I missing the point here or what??

Is it the https://www.velvetbox.co.uk part? On the previous message on this thread jpf mentioned that the urls should be :

IE: Normal (Un-Secure) site:
http://www.yoursite.com/catalog etc....

Secure (SSL) site:
https://www.yourhostsecuresite.com/~yoursite/catalog etc....

now for me this means that the unsecure site is : http://www.velvetbox.co.uk, but the secure site is : https://www.here4hosting.com/~velvetbox/catalog. This doesn't seem right at all.

I thought it would be https://www.velvetbox.co.uk because thats what the security certificate is setup as.

Help, this is really starting to annoy me.

thanks in advance

Tommy

[Arpit]

wheelie,

IE: Normal (Un-Secure) site:
http://www.yoursite.com/catalog etc....

Secure (SSL) site:
https://www.yourhostsecuresite.com/~yoursite/catalog etc....

now for me this means that the unsecure site is : http://www.velvetbox.co.uk, but the secure site is : https://www.here4hosting.com/~velvetbox/catalog. This doesn't seem right at all.

looks like ur site is a virtual site, and hence the different https address, in simple words, your velvetbox.com site is one of the many virtual sites on the www.here4hosting.com server.

One possible solution is to change

define('HTTPS_SERVER', 'https://www.velvetbox.co.uk');

to

define('HTTPS_SERVER', 'https://www.here4hosting.com/velvetbox.com');

Also, Im not sure what milestone ur using, if your configure.php has the lines regarding cookie domain, make sure you change them to look like:

define('HTTP_COOKIE_DOMAIN', 'http://www.here4hosting.com/velvetbox.com);
define('HTTPS_COOKIE_DOMAIN', 'https://www.here4hosting.com/velvetbox.com);

The whole virtual hosting crap sure can get very confusing, give this a shot

[wheelie]

brilliant, I'll give that a go and see what happens.

Thanks again

[wheelie]

Nope still didn't work unfortunately.

When I change it to that I start to get 404 file not found errors. Surely I should be able to at least see my certificate on this site, and I can't do that. I know its installed correctly as I have the output from the system when its installed it.

Any more ideas?

thanks