Problem with SSL

[JQPublic]

Using 1.38a
Classic Template
site is www.JohnsPetSupplies.com
I am using shared hosting with godaddy running all the up to date stuff.

I know this question has been asked a lot and I have read all of them (that I could find) and also the FAQ but I simply can not find why, when you click on login that it asks "do you want to view only the webpage content that was delivered securely?"

I have clicked "yes" and then viewed the source and there is no src="full URL" I did find a javascript that has the full URL but I have no clue how to fix that or even if it needs fixed.

If you would be kind enough to have a look for yourself and see if you see a problem and then tell me how to fix it I would be ever so greatful and pleased as punch too.

Thanks
JQPublic

[JQPublic]

Oh and one other thing. The link to the SSL is different than my website. it is https://saab.websitewelcome.com/~joh...ain_page=login

I think this is what the problem is... the fact that it is going to a different URL. Does that make sense?

[Ajeh]

Could you post, from the server, your file:
/includes/configure.php

without your username and password ...

[JQPublic]

]<?php
/**
 * @package Configuration Settings circa 1.3.8
 * @copyright Copyright 2003-2007 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 */


/*************** NOTE: This file is similar, but DIFFERENT from the "admin" version of configure.php. ***********/
/***************       The 2 files should be kept separate and not used to overwrite each other.      ***********/

// Define the webserver and path parameters
  // HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
  // HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
  define('HTTP_SERVER', 'http://www.johnspetsupplies.com');
  define('HTTPS_SERVER', 'https://saab.websitewelcome.com/~johnspet');

  // Use secure webserver for checkout procedure?
  define('ENABLE_SSL', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
  // these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
  define('DIR_WS_CATALOG', '/');
  define('DIR_WS_HTTPS_CATALOG', '/');

  define('DIR_WS_IMAGES', 'images/');
  define('DIR_WS_INCLUDES', 'includes/');
  define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
  define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
  define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
  define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');
  define('DIR_WS_DOWNLOAD_PUBLIC', DIR_WS_CATALOG . 'pub/');
  define('DIR_WS_TEMPLATES', DIR_WS_INCLUDES . 'templates/');

  define('DIR_WS_PHPBB', '/');

// * DIR_FS_* = Filesystem directories (local/physical)
  //the following path is a COMPLETE path to your Zen Cart files. eg: /var/www/vhost/accountname/public_html/store/
  define('DIR_FS_CATALOG', '/home/johnspet/public_html/');

  define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');
  define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');
  define('DIR_WS_UPLOADS', DIR_WS_IMAGES . 'uploads/');
  define('DIR_FS_UPLOADS', DIR_FS_CATALOG . DIR_WS_UPLOADS);
  define('DIR_FS_EMAIL_TEMPLATES', DIR_FS_CATALOG . 'email/');

// define our database connection
  define('DB_TYPE', 'mysql');
  define('DB_PREFIX', 'zen_');
  define('DB_SERVER', 'localhost');
  define('DB_SERVER_USERNAME', '***');
  define('DB_SERVER_PASSWORD', '***');
  define('DB_DATABASE', '***');
  define('USE_PCONNECT', 'false');
  define('STORE_SESSIONS', '');
  // for STORE_SESSIONS, use 'db' for best support, or '' for file-based storage

  // The next 2 "defines" are for SQL cache support.
  // For SQL_CACHE_METHOD, you can select from:  none, database, or file
  // If you choose "file", then you need to set the DIR_FS_SQL_CACHE to a directory where your apache 
  // or webserver user has write privileges (chmod 666 or 777). We recommend using the "cache" folder inside the Zen Cart folder
  // ie: /path/to/your/webspace/public_html/zen/cache   -- leave no trailing slash  
  define('SQL_CACHE_METHOD', 'file'); 
  define('DIR_FS_SQL_CACHE', '/home/johnspet/public_html/cache');

// EOF

[JQPublic]

Thanks so much for being willing to help. I am about ready to just give up and sell pencils on the street corner lol

John

[DrByte]

It would seem that your hosting account and/or SSL setup is not properly configured on the server, such that the traditional ways of determining whether the page is in SSL mode or not ... are not working.

The most common conventional indicators that a page is in SSL mode are handled via one or more of these factors:

$_SERVER['HTTPS']
$_SERVER['HTTP_X_FORWARDED_BY']
$_SERVER['HTTP_X_FORWARDED_HOST']
substr($_SERVER['SCRIPT_URI'], 0, 6)) == 'https:')
$_SERVER["HTTP_SSLSESSIONID']
$_SERVER['SERVER_PORT'] == '443'

Usually it's only Network Solutions hosting that refuses to configure their servers to work reliably. Most other hosts are usually delighted to fix such an issue as quickly as possible.
I think yours is GoDaddy isn't it? If so, you might have a bit of trouble.

[JQPublic]

Thank you for your post DrByte. I appreciate you taking time to post it. However I don't use Godaddy for hosting, I use HostGator who is usually right on top of everything.

So I will speak with them about it and see what can be done.

Yesterday I installed a program called HTTPWatch and it pointed out nothing out of the ordinary except maybe Hostgator's favicon.ico. Below is the report it showed me...

00:00:00.000 Login : John's Pet Supplies, Everything from A to Z for your Pets!
+ 0.000 0.839 573 48350 GET 200 text/html; charset=iso-8859-1 https://saab.websitewelcome.com/~joh...ain_page=login
+ 0.453 0.001 0 0 GET (Cache) text/css http://www.johnspetsupplies.com/incl...stylesheet.css
+ 0.531 0.001 0 0 GET (Cache) text/css http://www.johnspetsupplies.com/incl...ss_buttons.css
+ 0.533 0.001 0 0 GET (Cache) text/css http://www.johnspetsupplies.com/incl...n_lightbox.css
+ 0.534 0.001 0 0 GET (Cache) text/css http://www.johnspetsupplies.com/incl...stylesheet.css
0.839 573 48350 5 requests

Today it's not showing the favicon.ico for HostGator but it did yesterday. I was just wondering if that may be the issue. I am also attaching a zip file in excel just in case this isn't legible.

[DrByte]

On a technical level, the reason you're getting non-secure notices etc, and the reason why your css files etc are being loaded via non-SSL URLs is because the <base href> tag is being set to a non-SSL address.
And *THAT* is because the server is not properly advertising the fact that the page is running in SSL mode. As I said previously, the conventional tests are obviously not passing, so it's not able to properly detect the presence of SSL.

I'm guessing that maybe they recently renewed their shared SSL cert and fat-fingered something in the process.

[JQPublic]

Well I sent HostGator a support request. Let's see what they do with it.

[JQPublic]

well it seems that HostGator is claiming my problem is on my end. They claim the links in my information side box is causing the problem. Well I turned everything off I could turn off to the point that my page shows only the top 1/3 of the page but still they claim that the issue is not on their side. But sir you can buy our handy dandy private SSL, that'll solve the problem. ARRRRRRRGGGGGGGGGGHHHHHHHHHHH

anyway DrByte belkow is the server info they gave me...

[root@saab /home/johnspet/public_html]# grep saab ./admin/includes/configure.php
define('HTTPS_SERVER', 'https://saab.websitewelcome.com/~johnspet');
define('HTTPS_CATALOG_SERVER', 'https://saab.websitewelcome.com/~johnspet');

[root@saab /home/johnspet/public_html]# grep saab ./includes/configure.php
define('HTTPS_SERVER', 'https://saab.websitewelcome.com/~johnspet');

Maybe I'll just move my site to Bob's Pizza Shop and web hosting lol