SSL Warning - which doesn't belong to bugs or hacks

[zcnb]

I just installed Zen Cart on my web host's space, using Fantastico (I initially tried to do it manually but failed). Fantastico worked great for me.

However, there is an unclear problem (is it really a problem?) regarding login into the store's admin account, using https://mydomain/shop/admin/login.php .

When I type my admin userid and password and click login, Firefox warns me with the following message:

Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could esily be read by a third party.

Are you sure you want to continue sending this information?

Now... wouldn't the userid and password be encrypted even if I didn't use https?

If not, how come Zen Cart can offer password encryption for shoppers but for the store admin?

Or am I missing something? What am I missing?

Thanks,
Daniel

[kobra]

Have a look at your admin/includes/configure.php file for ssl settings

[zcnb]

Have a look at your admin/includes/configure.php file for ssl settings

Thank you! I didn't know about this.

I now read that section's comment:

   /* If you desire your *entire* admin to be SSL-protected,
        make sure you use a "https:" URL for all 4 of \
        the following:
   */
  define('HTTP_SERVER', 'http://mydomain.com');
  define('HTTPS_SERVER', 'https://mydomain.com');
  define('HTTP_CATALOG_SERVER', 'http://mydomain.com');
  define('HTTPS_CATALOG_SERVER', 'https://mydomain.com'); 

Which raises two new questions:

1. If I don't make my *entire* admin SSL-protected, does this mean that my password is transmitted over the Internet in CLEAR TEXT every time I login to my admin account?
2. If my SSL certificate is for https://secure.mydomain.com do I have to change the 2nd and 4th lines accordingly?

Thanks,
Daniel

[kobra]

A standard Cert is issued to a specific domain name and little things like www or not are differences that will throw an error

You state your cert is issued to secure.mydomain.com and if your Zen Cart is not there but at mydomain.com or www.mydomain.com you and your customers will receive a warning

I was really referring to the entries a few lines below that are

  // Use secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'false');
  define('ENABLE_SSL_ADMIN', 'true');

This will address your login user & pass being encrypted with a proper Certificate

[zcnb]

kobra, thank you so much for your help.

   define('ENABLE_SSL_ADMIN', 'true'); 

This will address your login user & pass being encrypted with a proper Certificate

Indeed, this line was set to 'false'. I changed it to 'true' and now I am prompted for login while the lower-right padlock symbol is on.

Now I am curious: Does that mean that when this setting is 'false', admin login & pass are transmitted clear text? If so, what is the reason for having this setting 'false' by default?

You state your cert is issued to secure.mydomain.com and if your Zen Cart is not there but at mydomain.com or www.mydomain.com you and your customers will receive a warning

Yes, I noticed that. If I want to configure the system so that my customers don't receive a warning, is it enough to change only the following line?

  define('HTTPS_SERVER', 'https://mydomain.com'); 

to

  define('HTTPS_SERVER', 'https://secure.mydomain.com'); 

Thanks,
Daniel

[kobra]

Now I am curious: Does that mean that when this setting is 'false', admin login & pass are transmitted clear text? If so, what is the reason for having this setting 'false' by default?

SSL Certificate is required to enable this functionality and this is a seperate item from Zen Cart and not all uses of the script require SSL i.e. a Showcase and therefore an SSL might not be utilized

[zcnb]

SSL Certificate is required to enable this functionality and this is a separate item from Zen Cart and not all uses of the script require SSL i.e. a Showcase and therefore an SSL might not be utilized

OK, this makes sense. I also incur from this that when this setting is 'false', admin login & pass are transmitted clear text even if an SSL certificate is installed. Am I correct in my understanding?


As for my last question, if I want to configure the system so that my customers don't receive a warning (let's ignore admin for now), is it enough to change only the following line?

  define('HTTPS_SERVER', 'https://mydomain.com'); 

to

  define('HTTPS_SERVER', 'https://secure.mydomain.com'); 

Thanks,
Daniel

[kobra]

As you should know - without encryption all data is transmitted in clear text by definition

As for your other issue - you need to determine this with your host and your admin files will have to exist in your subdomain at a minimum

[zcnb]

As you should know - without encryption all data is transmitted in clear text by definition

Of course. I was actually referring to a common "technique", used by some web sites in which the submission of the userid+password is encrypted although the page (in which the form that prompts for the userid/password) isn't. I understand that this isn't the case with Zen Cart. That's good to know.

Thank you very much for your clarifications.