Suddenly getting SSL Security Warning

[katco]

Several hours later, here is their reply to me:

"Thanks for your patience, I have been checking into your issue but I could not find any reason for this issue to happen due to php version change. The warning clearly tells that SSL is there but it can't encrypt some to the contents. As mentioned earlier if you use some hard coded URLs without https then such issues arise.

On the other hand there has not been any change in SSL settings. I have confirmed that shared SSL is installed and is working fine for Apache and all other services."

This was after it was escalated to 3rd level support.

I really do not believe I have any hard coded images, but just to make sure I am not wrong, how would a person check for that? I used my developers toolkit to find those images and nothing that got sent back to me on that search showed it. Is it possible that they could still be there even though I searched with the tookit?

I just do not know what else to look at or what to do.

[DrByte]

No, you didn't hard-code images.

The problem is that since the server's configuration doesn't expose that it's running in SSL mode, Zen Cart is unable to detect it despite trying all the conventional means.
And as such, Zen Cart is rendering page content as if it were non-ssl ... which is why you're getting the security warnings.

If the server administrator fixes the server configuration problem they created last week, all your secure-warning problems will go away.

[katco]

They are saying there were no server configuration problems or changes. I suppose it does not help that I cannot pinpoint the exact time the problem started.

I wish I knew what to say to them to convince them its on their end, but they don't believe me.

So, do I have to completely delete my store and start over? Is that my only option? Or will the problem still exist even if I do that?

Do you know for a fact that I didn't hard code any images? I'm just asking because if I could prove that to them somehow, maybe they would look at it differently.

[DrByte]

Deleting your store won't help.

You did say it was working just fine a couple weeks ago, right? And then *they* made some changes, right?

What did they say about the ssltest script I pointed you to? Surely they're not going to just wash their hands of it and say it's not their problem, when the code that does that detection within Zen Cart has not changed during the time that their server's functionality suddenly changed.

[katco]

No. I did say it was working a few weeks ago. And then yesterday and today there was some changes to the PHP on my server. But as far as any other changes, I have no idea if they made changes or not.

I don't know if they used the test script or not. I did tell them about my results, but apparently they don't believe them or think that its my images that are causing that response.

I have been with these guys forever and have never had any problems like this with them. So I am super frustrated by this point that I cannot seem to convince them its on their end.

[DrByte]

If your Zen Cart software and site content haven't changed, but changes have been made to the server's main configuration settings, and suddenly a problem started, the wildcard is the server configurations, not your Zen Cart software.

[katco]

The php changes were to my end.... I have both php 4 and 5 scripts so we set it up so I could run 4 where needed and 5 where needed. At this point I really dont know if there was any changes made to that directory or not.

I am unaware of any other server changes... there may have been some or there may not have been. I am trying to recall if I have made any zencart changes to that particular site, but being as how i manage about 17 zencart stores, its hard for me to recall everything. I am quite sure I didnt do any image changes, but hey, maybe I did. That is why I was asking about how I could double check my images to be sure.

[DrByte]

Well, you can certainly double-check all your images if you want.
But until your server is capable of sharing the required details so PHP can see that it's operating in SSL mode, you won't be able to test much.


Aside: Have you considered using a proper dedicated SSL certificate instead of a shared one?

[katco]

So, what I was asking earlier is: How do I double check my images besides searching them through the developers toolkit?

Yes, I have thought about that... but I already have other non shared ones. Prices add up. But, if I switched to one, would it fix the problem? because if so, I would do that.

[DrByte]

A dedicated SSL is unlikely to do anything with this situation, other than make your hosting company deal with yet another SSL factor.
It's just a good thing to do.

As for double-checking your images, etc, search your site for any hardcoded tags that say src="http: anywhere in your site. More specifics here: https://www.zen-cart.com/tutorials/i...hp?article=150