Securing store with a SSL Certificate

[milelk]

I am trying to secure my client's partially built store with a SSL certificate and can't find clear instructions on how to do this.

She has purchased the certificate from her web host who has installed it for me and I have changed the configure.php files by following the article "How do I configure for SSL/HTTPS (secure socket layer) after I have installed Zen Cart?" https://www.zen-cart.com/tutorials/index.php?article=14

The tutorial however, doesn't go into the rest which I see hinted at, but not fully explained in other posts I've searched regarding setting up your store to function with the SSL Certificate. The Wiki doesn't have any articles on it either. So my questions are thus:

1. What do I need to do now the certificate is installed?
2. People talk about copying files into another folder. What do I need to copy into the 'secure folder' to be protected by the SSL, the whole site or only certain areas?
3. How do I create that secure folder, do I do something special or name it something particular? Where does is sit in relation to her store?
4. Do I need to continually copy over certain folders into this secure folder as my client adds new products and new customers sign up?
5. Is there anything else I need to know about?

I'd really appreciate your responses to my queries, this security stuff is still very new to me. Thanking you kindly in advance!

[tophand]

If you followed the article in setting up your configure.php file correctly then you are all done.
Zen-Cart is smart enough to know when it needs to go in secure mode.

Mark

[milelk]

Thanks Mark! That's great to know I'm not missing anything more. I did notice though that the padlock is crossed out on the browser (I'm using Firefox). Doesn't it need to show a full padlock to reassure customers?

Emma

[milelk]

Hmm, I take that back, it seems to show a full padlock now... grey with a black and yellow hazard line across it? I was expecting a yellow padlock, but maybe i'm getting IE confused with FF..

[tophand]

Do you have a link?
Should be yellow padlock when in the secure area.
You can click on the padlock for more info.
Also note that https://www.yoursite. com and https://yoursite. com are not the same.
So if the secure certificate was genterated with https://yoursite. com and you are using https://www.yoursite. com you will get an error.

hth,

Mark

[milelk]

Its ok, when I open the site in Internet Explorer I get a yellow padlock which says "SSL Secured (128 bit)" when I hover my mouse over it. When I hover my mouse over the padlock in Firefox I get "Authenticated by Secure Business Services, Inc."

Weird that Firefox would choose a symbol that looks broken at first glance..

[Noodles1971]

This thread is very old but is most relevant to my current problem:

My host installed a dedicated SSL cert on my site and I followed the instructions in the tutorial mentioned already here to enable it https://www.zen-cart.com/tutorials/index.php?article=14.

I made the required changes to /admin/includes/configure.php and to /includes/configure.php. While I was successful with the admin section and I can now see the padlock symbol in Firefox (with note "Authenticated by Thawte, Inc." when you hover over it with the cursor), I was not successful with the main site and I get a padlock symbol with an exclamation mark, also in Firefox. The message received when I hover over it is "Warning: contains unauthenticated content". I cleared the cache and cookies as required so it is definitely not working. I'm wondering why it failed and looking more closely at my configure.php file, there is an extra line as follows:

define('HTTP_SERVER', 'http://www.snugbabyshop.co.uk');
define('HTTPS_SERVER', 'https://www.snugbabyshop.co.uk');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');


My questions is, does this extra line limit the pages secured to just the checkout pages of my site and if not, any suggestions as to what to do to investigate what happened and to also ensure that the SSL cert is also enabled for my Paypal return URL?

Many thanks in advance.

[Ajeh]

You are pulling that PayPal image from a non-secure site ... so when you go to a secure page, that is triggering the warning ...

[Noodles1971]

Thanks, but please excuse my ignorance as I dont know what you mean

Its interesting you mention Paypal as i'm having trouble with that also and maybe they're related. I get the "non-secure form" message when I try to return to my site following a transaction on Paypal (hence, trying to enable the SSL cert for both my homepage and return URL) but then when I select "ok" on the message, I get another message "not acceptable. An appropriate representation of the requested resource /index.php could not be found on this server" and a customer cannot return to my site. Also, the status of the Paypal IPN module on my admin is "processing" and when that is selected, I get a similar "not acceptable" message to the above, this time relating to the modules.php file. So I cant even uninstall the module in order to try to re-install or to install the Paypal Express Checkout module (which is recommended by Zencart).

I was going to raise this as a separate thread - do you think they may be related and could you maybe explain a little more about your answer to a new (and very ignorant!) zenner???

[Ajeh]

I don't know ...

I know that you have a PayPal image with visa/mc on it and are calling it from another site ... as it is not secure, you get these errors on secure pages ...

Either get permission for the image to be on your site and call it correctly for a secure page or find the secure url for the site that you are using it from ...