Procedure for Setting Up SSL

[Peace Freak]

From what I have read, SSL is a must to use these days...

I have set up my Zen-Cart but not with SSL. I did a search in the WIKI docs but did not come up with the general setup procedure!

Could someone give me an overview of the procedure and what to watch out for, etc? As I do not have it currently set, do I need to change any settings?

Thanks in advance!

[kobra]

As you are most likely using a host, they should be able to set your SSL side of things up. If a private SSL this will reside at your domain.

If a shared SSL, there are various methods that hosting providers use to implement. Your provider should be able to provide these details. ecommerce savvy providers through hosting magic only provide the url of the SSL certificate others require that some files exist at this url. Again the provider should know their requirements if they don't (run)...

Zen Cart only needs to know where the SSL is and there are a couple of entries in each of the configure.php files that must point to the url. These are prefaced with the https:// locator.

For a private SSL this would be htpps//www.your_domain

For a shared SSL this might look more like htpps://mysecureserver.your_host


wiki SSL info
Some Info You can search for additional

[Peace Freak]

Thanks for getting back to me... I have made some enquiries with my hosting company.

They provide, on my shared server, a SSL certificate for free, or they said I can purchase my own from a third party.

At this point in time, as we do not anticipate high sales, we are just using PayPal. In the future this may change.

What would be recommended for this situation?

Thanks!

[kobra]

If you only accept PayPal, you do not need an SSL, as all the sensitive information will be passed only after their SSL site has been entered.

[Merlinpa1969]

but if they provide a FREE shared ssl I would suggest setting it up,
get the shared SSL url from them and then in
includes/configure.php
and
admin/includes/configure.php
at the top above where it says SSL true or false
look for the define https and put the shared url in there,
then set ssl to true

[Peace Freak]

OK then, I will go with the shared SSL for now...

One more question, why would people buy a SSL certificate if they can use a shared one.

What are the down sides to a shared cert? What are the basic determining factors that one needs to keep in mind? This is not only for me but for other readers too...

Thanks!

[Reesy]

Because the ssl path would be different from your site and it looks different/ less professional (in my view) and can cost you customers (again my view).

www.example.com
will change to something like

www.servername-yourusername.com
ie nothing like example.com when they enter a secure page.

I have seen with my own eyes people closing the window at that point as they dont understand why the url has changed.

[zenartman]

Shared ssl is like crutch you use until you can go on your own. At least my experience is so. Eventually it was better to get a private.

[supplymydorm]

If you only accept PayPal, you do not need an SSL, as all the sensitive information will be passed only after their SSL site has been entered.

So is name, address and phone number not considered sensitive?
I have having some track due to not having SSL, I will accept payments from Paypal but in the future (before the end of the year) hope to access google (as they do not have any fees). Does anyone have any comments on this issue?