SSL Problem (Base href???)

[DaveS]

Hi there,

Could someone please look at http://www.hairrigs.com ?

I've just installed SSL but I'm getting errors saying that some items are not secure. It appears that (for starters) all the CSS is not secure because just prior to the stylesheet lines in the code there is...
<base href="http://www.hairrigs.com/" />

configure.php looks like this...
// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
define('HTTP_SERVER', 'http://www.hairrigs.com');
define('HTTPS_SERVER', 'https://www.hairrigs.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');



Certificate is issued to http://www.hairrigs.com



Any ideas anyone??

Thanks,
Dave

[schoolboy]

Zencart will only invoke SSL when there is a need for it... Such as when people send personal or payment data over the internet. SSL slows a site down, so you don't want SSL all the time.

If you are getting "This page contains insecure elements" warnings, it means that when it is in https mode, the page has links in it that are not https.

Generally, these occur when you hard-code hyperlinks, or call a url into a page which is absolute and http.

When the warning appears, it will ask you "Do you want to display these elements?"

Choose "NO"... and you can then inspect the page for the problem URL's and decide on your course of action with these links.

[DaveS]

Hi there,

Thanks for your reply. I understand the bits you mention and I don't have SSL on the whole site, just the checkout pages etc.

I've already determined that it's the CSS that is not secure as it's being called as http:// rather than https:// due to the base href command before the stylesheet lines.

Any ideas?

Cheers,
Dave

[dbltoe]

Your stylesheet is probably the ONLY correct link on the login page.
Most all the others are hard-coded. No matter what you do to those, the Google link will continue to bomb the ssl.

I see we have a new contender in the messed up template category. TM meet Acadame

[DaveS]

Uh-oh, that doesn't sound good. What's TM?

Could you suggest which files I need to start editing to put things right? Is it just a case of changing the links from absolute to relative?

[DaveS]

Looked at the files and I see it's not as simple as I thought....

Ditch Acadame or learn php?

[dbltoe]

There are so many things
TM is template monster and it appears your template is trying to join them in manipulating code that looks great till you need to make the slightest adjustment. In TM's defens, I've never seen the absolute links in their log in pages.

First clue of problems (to me), is the Log Off and My Account links which (in real Zen Cart) wouldn't show up till I was logged in to the site.

Try backing out of this template to the classic template and see what happens with the ssl. My guess is you won't see any absolutes in the page source (with the possible exception of the Google link mentioned before)

[DaveS]

Ah Template Monster... that makes things worse, I had just started to think that at least I can buy a Template Monster template if I can't get acadame to work..... it was going so well until this too!

Thanks for your help, i'm going to have to have a think on this one...

[dbltoe]

The "things we've done" in my sig were done in the stylesheet and using our own graphics. One of them is a free template that we modified slightly. You might even find one you can modify at Kuroi's (sorry, site offline)

[DaveS]

Thanks, I'll check the links out when I finish banging my head against the wall....

Still struggling, back to default template but something still causing trouble. Am I right in saying that links to non-ssl pages are ok, for example
<li><a href="http://www.hairrigs.com/conditions">Conditions of Use</a></li>

That's just standard zen cart right?

I have this dubious line

getFile("http://www.hairrigs.com/javascript_check.php?zenid=014d7e471190fbf3157f026ac9b4d053");

Think that's part of fast and easy checkout but not 100%...




PS: the my account and log off links were put in by me with an easy page as they weren't showing at all, so acadame not entirely to blame there!