SSL problem

[sparklefish]

I've just set up SSL for my site by doing the following:

1) Created subdomain secure.sparklefish.co.uk

2) Bought a SSL cert for secure.sparklefish.co.uk and installed on server via cPanel

3) Changed configure.php to read
// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg, http://www.yourdomain.com
// HTTPS_SERVER is your Secure webserver: eg, https://www.yourdomain.com
define('HTTP_SERVER', 'http://www.sparklefish.co.uk');
define('HTTPS_SERVER', 'https://secure.sparklefish.co.uk');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

However, when I try to access customer login I get the following message (Firefox):
"The connection to www.sparklefish.co.uk was interrupted while the page was loading."

I know I've done something wrong but not sure what. Anything obvious or should I contact my web host? Do I need to move any files into another directory?

Thanks

[sparklefish]

Sorry, my mistake, the error message reads

The connection to secure.sparklefish.co.uk was interrupted while the page was loading.

[Vger]

You didn't restart Apache after installing the full ssl cert, so it's still listed as being the self-signed cert for 'sparklefish.co.uk'

Vger

[sparklefish]

Thanks - my web host has reinstalled the cert and but now get a page not found error.

Sorry for the basic question, but do i need to move code to another folder (ie the secure folder?) I've set up the subdomain secure.sparklefish.co.uk and have a SSL for secure.sparklefish.co.uk?

[lib99]

Yes. If your host has provided you an http AND https directory space, then you will need to maintain a copy of your Zen Cart in both directories. Your admin/includes/configure.php AND includes/configure.php files also need to reflect the correct paths.

See the following for additional guidance. FAQ :: How do I configure for SSL/HTTPS (secure socket layer) after I have installed Zen Cart?

[sparklefish]

Thanks - my inexperience in these things is showing.

I'm going to try and get my SSL cert changed to my whole site rather than the secure sub-domain. If no joy, then I'll maintain 2 versions of the cart in both locations (not preferred).

I'll also sort out the admin SSL as you say.

Cheers

[lib99]

Technically SSL 'best practices' is to have 2 separate file locations. One for non-secure and one for secure. It is quite common to have the 2 directories and maintain as such.

(Typically you would only place the necessary files in the https directory. However, it is just plain easier to maintain a complete second copy of your Zen Cart in both.)

[Vger]

The only reason you need to have two sets of files is because your hosts didn't set up the server correctly. If the server uses a Plesk control panel then all they needed to do was to tick a box during the server setup to use just one fodler for http and https files. On any other control panel they can 'symlink' (symbolically link) the httpsdocs folder to the httpdocs folder and then you only need to maintain one set of files.

I have to admit that I don't know why it would be "SSL best practice" to have two separate sets of files/folders, and after six years in hosting have never heard of such a rule.

Vger

[lib99]

I have to admit that I don't know why it would be "SSL best practice" to have two separate sets of files/folders, and after six years in hosting have never heard of such a rule.

So as not to hijack this thread down a different path of discussion, I'll briefly reply. I agree with your statement and have asked many over the years. Opinions are fairly balanced. In theory, why encrypt pages, files, etc...if your going to have the same ones available via http AND https? It's not a "rule", but a good practice. Keeping in mind that there are many different types of web applications, it is a general statement. Perhaps a diminishable one as web servers and their applications become more secure in their design and execution.

[sparklefish]

Based on what this thread is saying is it therefore possible to:
- redirect my subdomain (secure.sparklefish.co.uk) to www.sparklefish.co.uk
- ask my webhost to symbolically link the httpsdocs folder to the httpdocs folder

and thus only have 1 set of files to maintain. Would this work in my case?