Problem with SSL

[ak6000]

I started building my site without SSL Certificate and I was able to build and run the site without any problem.

Since I was getting ready to go live, I purchased a dedicated SSL certificate from my hosting company and got it installed. The certificate is issued for "shinypetstore.com" and not "www.shinypetstore.com".

I followed the recommendation from tutorial and made the following changes to my config.php files as follow:

For include directory I changed the following:

define('HTTP_SERVER', 'http://www.shinypetstore.com');
define('HTTPS_SERVER', 'https://shinypetstore.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

and for admin/include directory I changed the following:

define('HTTP_SERVER', 'http://www.shinypetstore.com');
define('HTTPS_SERVER', 'https://shinypetstore.com');
define('HTTP_CATALOG_SERVER', 'http://www.shinypetstore.com');
define('HTTPS_CATALOG_SERVER', 'https://shinypetstore.com');
define('ENABLE_SSL', 'true');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

Now, when I type either www.shinypetstore.com or shinypetstore.com I get redirected to https://shinypetstore.com and everything looks good. However, when I try to add a product to cart or under admin I try to make a change I get this error message:

"Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.

Are you sure you want to continue sending this information?"

and the system ignores my changes!

What am I doing wrong? Do I need to make additional changes?

I appreciate your help.

[frank18]

Your includes/configure.php should look like this

// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
define('HTTP_SERVER', 'http://www.shinypetstore.com');
define('HTTPS_SERVER', 'https://shinypetstore.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_CATALOG', '/');

and the corresponding admin/includes/configure.php

define('HTTP_SERVER', 'http://www.shinypetstore.com');
define('HTTPS_SERVER', 'https://shinypetstore.com');
define('HTTP_CATALOG_SERVER', 'http://www.shinypetstore.com');
define('HTTPS_CATALOG_SERVER', 'https://shinypetstore.com');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_ADMIN', '/Your_Admin/');
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_ADMIN', '/Your_Admin/');
define('DIR_WS_HTTPS_CATALOG', '/');

make sure to set permissions to 644 before making changes and back to 444 after you are done

If this does not fix it then your host may have enabled a permanent redirection from http to https. That is not desirable.

[ak6000]

Thanks Frank,

This is exactly what I have!

So, do I need to ask them stop redirecting http to https?

[frank18]

Thanks Frank,

This is exactly what I have!

So, do I need to ask them stop redirecting http to https?

If you have cPanel on your server you may be able to stop that redirection yourself. If not then you need to check with your host if they have set up a redirection for the whole site to be https.

Zencart is smart enough to only use SSL connections for specific sensitive pages like login, create account, checkout pages, admin login etc.

Any other pages should only be called as Non-SSL.

To achieve this you have made the necessary changes in the 2 configure.php files (and they look ok to me )

In my opinion your host did not install or configure your cert correctly.

[ak6000]

Frank,

You were right on money!

I found that they have added a redirect to .htaccess that was forcing http to https. Removed it and everything is working perfectly.

Thanks so much for your expert advice.

[frank18]

Frank,

You were right on money!

I found that they have added a redirect to .htaccess that was forcing http to https. Removed it and everything is working perfectly.

Thanks so much for your expert advice.

I'm not an 'expert' by any means but love to help where I can