Suddenly getting SSL Security Warning

[katco]

Can you tell me if you think it is possible that this could have anything to do with a change in PHP? That's the only thing that has really changed that I know of and they are tellling me that there has been no changes in the shared cert on their end.

[DrByte]

PHP change, maybe.
Apache change, definitely.

[DrByte]

I really hate having to teach hosting companies how to configure their servers. Especially when it comes to SSL. If they can't do it right, they ought not to be doing it in the first place.

This post has a tool they can use to keep testing things to determine when they've fixed the problem they created: http://www.zen-cart.com/forum/showpo...87&postcount=4

[katco]

Is that something that I can use too? Can I try it before I send it to them, or could I mess up something with it?

Thank you!

[DrByte]

You can certainly try it yourself.

If it's working properly, when you access it using an https URL it should say Protocol: SSL. Otherwise it'll say Protocol: NONSSL.

I might suggest putting the file in your /extras/ folder, and maybe giving it a slightly different filename, just so snoopers don't go using the file and gleaning information about your server that they've got no business knowing.

[katco]

Or I could just delete it when I am done? I usually dont leave stuff like that on my server.....

[DrByte]

Or I could just delete it when I am done? I usually dont leave stuff like that on my server.....

most definitely ... it should never be left on the server
use it only when needed

[katco]

Several hours later, here is their reply to me:

"Thanks for your patience, I have been checking into your issue but I could not find any reason for this issue to happen due to php version change. The warning clearly tells that SSL is there but it can't encrypt some to the contents. As mentioned earlier if you use some hard coded URLs without https then such issues arise.

On the other hand there has not been any change in SSL settings. I have confirmed that shared SSL is installed and is working fine for Apache and all other services."

This was after it was escalated to 3rd level support.

I really do not believe I have any hard coded images, but just to make sure I am not wrong, how would a person check for that? I used my developers toolkit to find those images and nothing that got sent back to me on that search showed it. Is it possible that they could still be there even though I searched with the tookit?

I just do not know what else to look at or what to do.