SSL Certificate Problem

[LittleScruffs]

Hi,

I am just writing to ask for some advice regarding our new SSL certificate.
We had a thawte SSL certificate installed to protect our websites checkout and login pages. Our developers copied our site into the httpsdocs directory on our server, however, now when a user moves through the pages on our checkout they are met with a security warning at every move:
"Security Warning - Although this page is encrypted, the info you have entered is to be sent over an unencrypted connection and could easily be read by a third party"

I'm really concerned about this and our web developers don't seem to be able to fix it.
I paid the technical team from our hosting company to have a look over the problem to see if they could fix it. This was their response:

"Normally this wouldn't be a problem - Zen Cart has a simple yes / no switch to set whether it should use ssl for protected pages or not, but it would seem that someone has been messing around with this and broken it."
"Regarding the SSL, there is a FAQ on the Zen Cart site here
https://www.zen-cart.com/tutorials/index.php?article=14
that describes how to set up a SSL, however the steps described in this had already been done. As I said yesterday, unfortunately because the code has been messed around with the SSL bit is broken. Due to the use of this Zen Cart, it will take far longer than the originally proposed 2 hours to attempt to fix this - indeed I would say that it would be quicker to re-install it from the Zen site. I'm guessing this is why your developers were reluctant to make the changes themselves."

I'm really at a loss as what to do to fix this. Our developers don't seem to know what they are doing.
My website is www . littlescruffs . com
I would be so so grateful if anybody could offer any help. We would also be very willing to pay someone with the technical inclination to get this sorted for us.

Thanks for the help

[kuroi]

If you want somebody to look at this, I recommend that you create a test account through which people can access your checkout. Has the extra benefit of helping you to differentiate between people interested in your products and those offering technical help.

[dbltoe]

It always bothers me to see

Our developers copied our site into the httpsdocs directory on our server

ESPECIALLY when it's not followed by

and they made the required changes to both configure.php files

Your cart was set up somewhat automatically in that Zen Cart searches for its current setting an builds the configure.php files with that info. Any directory change must be reflected in the configure.php files or strange things will occur.

[Website Rob]

Would it be correct to say the problem has been solved?

Using either FF or IE 8 to view your 'https' login page shows no Warnings at this time.

[dbltoe]

littlescruffsDOTcom/index.php?main_page=login
Still dies when clicking on sign up

[Website Rob]

littlescruffsDOTcom/index.php?main_page=login
Still dies when clicking on sign up

You need to include www

[LittleScruffs]

Would it be correct to say the problem has been solved?

Using either FF or IE 8 to view your 'https' login page shows no Warnings at this time.

No I'm afraid this hasn't been solved.
I've set up a test account so anyone can log in to our checkout and see these error messages:
Email. [email protected]
Pass: test123

Our developers just don't know what they are doing! I keep harrassing them to get the problem sorted and they now simply send me links to Zencart FAQ pages telling me how to set up my own SSL!!
I feel they have left me in a big mess and if I had the technical ability to do all of this myself, I wouldn't have paid the developers to do this for me.
I know something is very wrong, but if anybody has a possible solution or is able to fix this (for a fee of course). I would be very interested to hear from them.

Thank you very much

[kuroi]

It looks to me as though some of your page templates have been changed and in making these changes the security that should apply to some of your pages has been lost.

But others work fine, which shows that it's not the SSL certificate or it's installation that's at fault.

Rather I suspect that your developers have altered links and form submissions in ways that negate the way that Zen Cart makes sure that the pages that need to be secure are.

The ones that leapt out at me were the login page, but much more importantly than that the form that submits payment information is submitted to an http link instead of https. In other words your customers credit card details are being sent unencrypted, even though you have SSL installed.

This is probably going to be because they have made changes to the relevant page templates and either not used, or messed up the Zen Cart form and link functions. But unfortunately we can't see this from the pubic side of the site.

You could test this by switching back to the classic template briefly and seeing whether the problem goes away. If it does, it's restricted to the template level, if it doesn't they it's as a result of deeper changes.

As an aside however, I strongly recommend against hosting arrangements that require a duplicate of the site in an httpsdocs or similar. Having to keep both versions in sync is a challenge just waiting to go wrong.

[frank18]

Could you please post the relevant lines in your includes/configure.php and admin/includes/configure.php files (minus any sensitive info).

Alternatively PM me with a copy of the files (minus any sensitive info).