Changes in .htaccess and SSL

[Olga]

Hi everyone,
I am experiencing certain problems with the SSL connection. The problem is that I can not change anything from the admin area (like edit customers, or installing SQL patches), if I follow the directions from my hosting.

Basically I did the following.

1. Changed the content .../includes /includes/configure.php Now it has:

// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
define('HTTP_SERVER', 'http://www.myDomain.ca');
define('HTTPS_SERVER', 'https://www.myDomain.ca');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');



2. Changed the content of .../admin/includes/configure.php So now it has:

/**
* WE RECOMMEND THAT YOU USE SSL PROTECTION FOR YOUR ENTIRE ADMIN:
* To do that, make sure you use a "https:" URL for BOTH the HTTP_SERVER and HTTPS_SERVER entries:
*/
define('HTTP_SERVER', 'http://www.myDomain.ca');
define('HTTPS_SERVER', 'https://www.myDomain.ca');
define('HTTP_CATALOG_SERVER', 'http://www.myDomain.ca');
define('HTTPS_CATALOG_SERVER', 'https://www.myDomain.ca');

// secure webserver for admin? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_ADMIN', 'true');

// secure webserver for storefront? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_CATALOG', 'true');


3. To enable SSL I followed the instructions form my hosting and changed .htaccess at the root folder to include
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule (.*) https://www.myDomain.ca/$1 [R]


Without the last step (changes in .htaccess) zen cart is working perfectly, but the connection is unsecured. With the changes in .htaccess any change from the admin area gives me a security warning
"Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.

Are you sure you want to continue sending this information?"

If I press on "Continue" I get the same page with all fields blank. However, no changes are made - I can see the the same fields I had before the attempt to edit.


With the last step connection is secured, and everything except admin area is working.

Thank you for help.

[Ajeh]

In the Admin file:
/your_secret_admin/includes/configure.php

Set all of these to https:

define('HTTP_SERVER', 'https://www.myDomain.ca');
define('HTTPS_SERVER', 'https://www.myDomain.ca');
define('HTTP_CATALOG_SERVER', 'https://www.myDomain.ca');
define('HTTPS_CATALOG_SERVER', 'https://www.myDomain.ca');

// secure webserver for admin? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_ADMIN', 'true');

Now the whole Admin will be SSL ...

[Olga]

Thanks, Ajeh!!!
This solves my problem!

[Ajeh]

You are most welcome ... thanks for the update that this is working for you now ...

[lhungil]

...
3. To enable SSL I followed the instructions form my hosting and changed .htaccess at the root folder to include
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule (.*) https://www.myDomain.ca/$1 [R]
...

I'd recommend against using this snippet at all. It does not carry over query strings and can break POST requests made with HTTP. If you must "force" incoming links to HTTPS, the snippet should take both of these possibilities into consideration. Otherwise data may be lost. Additionally, links generated on the site should all use HTTPS (SSL) before using mod_rewrite to force requests from HTTP to HTTPS (to avoid extra unnecessary redirects).

As already noted, simply changing the two "configure.php" files to list the server stating with "https://" will tell Zen Cart to generate all links with HTTPS (SSL). If one needs more than just the admin always in SSL (for example the entire website), this method works as well... Although there are some good reasons Zen Cart "out of box" does not make the entire website use HTTPS (SSL).