SSL Warning - Fails To Load Stylesheet

[TwoWayRadio]

Have followed the instructions down to the button for enabling SSL on zen cart and changed the 2 config files.

However, when loading a 'secure' page, such as login, I get a IE warning saying "Do you want to display only the secure content". That's fine if it's just the odd image that is missing but if I choose yes the page loads with NO images, layout messed up and no buttons. I SUSPECT the style sheet is not loading, but the page is such a mess with secure content only that I dont know where to begin.

The main site is at http://dksales.co.uk and when you go to a secure page it directs you to the secure copy of the site on our secure server @ https://secure9.prositehosting.co.uk/secure-zone

Since it's a shared SSL I have identical copies of the site on the SSL and normal HTTP servers. It's all configured correctly and Zen Cart seems to be sending people to secure pages when it's supposed to.

Am running v1.3.9e with the pure_blue_free template.

I'm not bothered about the odd image being non-secure and getting the warning, I can address these in time. As long as if the user selects YES to the IE prompt then they can still see a workable version of the page, which right now isn't possible unless they opt for the mixed content option.

I just want to get the images/buttons and stylesheet working for now, everything seems ok and is set to use relative paths, except on the login page I can see there's a
<base href="http://dksales.co.uk/" /> if thats the issue then do I need to change that on all the secure pages, and if so which ones?

Any ideas?

[econcepts]

If you have hard coded links to images on your page into your stylesheet (in the form of http:// path to your images) then the secure site will try to pull the non-secure version of the files.

You'll need to either put the https:// (secure version) in front of the image references in the styelsheet or put the virtual reference (example would be like '../path to image here').

I went to your site and it doesn't look like the stylesheet is referencing incorrectly so I suspect that the header / footer / etc... has been hard coded with the http:// path to the images (thus causing your IE warning).

It looks this way because when I view the image properties on the secure site they point to the http:// version.

So although you might have zen cart setup correctly to forward to the SSL version of the site, the image references are still hard coded (in the design) to the non-secure versions.

The base href pointing to the non-secure version could be doing it to you BUT, that is pre-built into zen cart to switch to the secure version when zen is setup correctly so I don't think that is the case here either. You 'll find that in the html_header.php file (in your custom template's 'common' folder.)

[TwoWayRadio]

econcepts,

That's great thank you for that. I'll change all the image references to https:// is that only on the header and footer pages yes? :-)

Only thing is with the style sheet it's not just the images. I suspect the sheet isn't loading at all since the text isn't formatting. Any ideas whats causing that problem?

See what you mean RE ZC auto sensing it's secure. Interesting though that if you click login even on the secure only option on the login page the 'login' link at the top takes you to the http:// version, go to the http version and the login link becomes https://. Baffling, any ideas?

[econcepts]

It sounds like you must have something setup incorrectly still. If you have SSL turned on (active from the config files) and everything is pointed to the corrected locations, you should get a secure login page when you click that link.

When I look at your site, I get the secure version of the page (login) every time, and no matter where I click it from.

I did test clicking the actual 'submit' login button and that took me to a non-secure version of the page. Is that what you are talking about?

[TwoWayRadio]

It sounds like you must have something setup incorrectly still. If you have SSL turned on (active from the config files) and everything is pointed to the corrected locations, you should get a secure login page when you click that link.

When I look at your site, I get the secure version of the page (login) every time, and no matter where I click it from.

I did test clicking the actual 'submit' login button and that took me to a non-secure version of the page. Is that what you are talking about?

Yeah that's one of the problems - when you click login and go to the actual secure login page the 'Log In' and 'Register Links' point to non-secure versions, click the links to view the non-secure version and on the non-secure version they point to the secure version . Like you say clicking submit from secure takes you to unsecure and vice versa.

Here's my config files, which are the two files I've changed to enable SSL

----- /htdocs/admin/includes/configure.php


*/
define('HTTP_SERVER', 'http://dksales.co.uk');
define('HTTPS_SERVER', 'https://secure9.prositehosting.co.uk/secure-zone');
define('HTTP_CATALOG_SERVER', 'http://dksales.co.uk');
define('HTTPS_CATALOG_SERVER', 'https://secure9.prositehosting.co.uk/secure-zone');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

----- and /htdocs/includes/configure.php

// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
define('HTTP_SERVER', 'http://dksales.co.uk');
define('HTTPS_SERVER', 'https://secure9.prositehosting.co.uk/secure-zone');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

Have I missed a step or maybe need to check another file?

Thanks again for your help, really appreciated

[spid3r1987]

dont know if this will work for yourself or not, but i had a similar problem with certain hosting companies..

not 100% sure, but look in
includes/templates/classic/common/html_header.php
in there...IIRC
Line 39...
will be
"<base href="<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />"
but change it to
"<base href="<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTPS_SERVER . DIR_WS_CATALOG ); ?>" />"
this should force the catalog to load stuff via HTTPS, but show the URL as HTTP till HTTPS is needed(e.g checkout etc)

this has worked for myself and a few other people i know

its a simple edit, and if it dont work, just change it back

[DrByte]

I would recommend *not* touching html_header.php.


What is the webserver software being used on your server? Apache? IIS? Something else?
Who is the hosting company?

[spid3r1987]

I would recommend *not* touching html_header.php.


What is the webserver software being used on your server? Apache? IIS? Something else?
Who is the hosting company?

i generally wouldn't reccomend touching any of the core coding, but its the only way that i could get my problem fixed....due to hosting company being rubbish...

but...by doing that...if it works, might give you genius's an idea on WTF is wrong???

[TwoWayRadio]

I would recommend *not* touching html_header.php.


What is the webserver software being used on your server? Apache? IIS? Something else?
Who is the hosting company?

Fasthosts Business Reseller Package. Apache running on CentOS.

I've seen some negative feedback re Fasthosts and the way they do SSL on shared servers, they wouldn't have been my choice of a host but unfortunately the MD here was already tied into a 12 month contract with Fasthosts and has several other websites hosted under this package - until we start generating some revenue he won't entertain the cost of switching hosts - so for now at least I've got to make do with this.

[TwoWayRadio]

dont know if this will work for yourself or not, but i had a similar problem with certain hosting companies..

not 100% sure, but look in
includes/templates/classic/common/html_header.php
in there...IIRC
Line 39...
will be
"<base href="<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />"
but change it to
"<base href="<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTPS_SERVER . DIR_WS_CATALOG ); ?>" />"
this should force the catalog to load stuff via HTTPS, but show the URL as HTTP till HTTPS is needed(e.g checkout etc)

this has worked for myself and a few other people i know

its a simple edit, and if it dont work, just change it back

Thanks for the suggestion, gave it a whirl but the secure pages still don't load with a Style sheet. Also still doing it's strange quirk where the login & register links on the secure login page show unsecure links - whereas on the unsecure version they revert to secure. That said you've managed to get me to identify another possible issue which I'm hoping you chaps can help with;

After that change the images on the homepage (coded in the ez page html inserted for the main page) now reference the https source... If I right click the x'd placeholder for image 'leasing.jpg' on the home page it's got a path it from...

https://secure9.prositehosting.co.uk/images/leasing.jpg

when it SHOULD be

https://secure9.prositehosting.co.uk...es/leasing.jpg

As such it's not displaying the image! Is this why images and stylesheets on the secure side aren't loading elsewhere, since it's looking for the images folder in the root of secure9.prositehosting.co.uk rather than in the subfolder 'secure-zone' (my https folder)?

I know if I reverse spid3r1987's suggestion then that will mean the images on the home page show up from the unsecure server and display correctly but on the login page and secure pages could it be doing the same thing?