SSL Certificate - indicator not showing in browser address bar

I am using v1.3.9h

the following is happening on two(2) sites (one is the site in my signature)

I have checked and re-checked that the configure.php is correct in enabling SSL (true) in both admin/includes/configure.php and also includes/configure.php however the coloured area next to the address in the address bar is not showing when connecting to the site by www. mydomain. The auto re-direct to https:// isn't working. When I type the full address in the browser using https: //www. mydomain the coloured tab appears, confirming that the certificate is functioning.

Originally I had the admin/includes/configure.php set for only catalogue as "true" for SSL but have now also tabbed admin as true but still no change. The concern is twofold - firstly that savvy online shoppers will not see the SSL validation and leave the site pronto (might explain the high bounce rate) and secondly is the cart checkout secured? I cleared cache and cookies after making the configure changes.

Am I missing something here?

cheers,
Mike
p.s. the host, GoDaddy, from where I got the certificates indicated some changes to .htaccess file should have taken place ??

shags38:

I have checked and re-checked that the configure.php is correct in enabling SSL (true) in both admin/includes/configure.php and also includes/configure.php

What do you have for your HTTPS_SERVER settings in the config files? They need to be 'https://yoursecure.domain.com'.

shags38:

https: //www. mydomain the coloured tab appears, confirming that the certificate is functioning.

Funtioning yes. Does it make me confident to buy from your store. No.

shags38:

The concern is twofold - firstly that savvy online shoppers will not see the SSL validation and leave the site pronto (might explain the high bounce rate)

Firstly, there is no evidence to suggest shoppers will leave a site with no SSL.

Secondly, the tech savvy will avoid your site like the plague because your store name is "www.jewelleryonlinestore.com.au" but the SSL certificate is issued to
"harmonyballpendants.com" (which I assume is your other store). No matter, the fact that the Certificate doesn't match the store should raise alarm bells to anyone that visits (and most web browsers). You are better off without a certificate than you are to have one for what is apparently a different store.

shags38:

and secondly is the cart checkout secured?

If they checkout with PayPal express, and assuming by 'secure' you mean 'encrypted during transmission', then Yes (they will be using PayPals SSL, rather than yours).
If by 'secure' you mean that no one can gain access to their data after the order has been placed, then the answer is No (SSL can never provide such security).

If you have another definition of security you'll need to specify what you mean before I can provide an answer.

Does a Site with one domain name using a certificate for a totally different site make me feel 'secure' about conducting business with you. No. Not at all.

It a bit like have two watches. With one watch you always know the time. With two watches you can never be sure which one is accurate. :)

shags38:

Am I missing something here?

Your HTTPS server settings in the config files are incorrect. (my 1st guess)

shags38:

p.s. the host, GoDaddy,

Shhhh. Don't mention that name around here.. Many folks will ignore your pleas' for help.

shags38:

from where I got the certificates indicated some changes to .htaccess file should have taken place ??

Generally not. With GoDaddy, nothing surprises me.

Cheers
Rod

Check SSL Cert

Personally I would have got two certificates .
one for each store.
Rather then have them lumped together like this in one cert.

Firstly many thanks Rod for such a quick and very detailed response - much appreciated.

RodG:

What do you have for your HTTPS_SERVER settings in the config files? They need to be 'https://yoursecure.domain.com'. they are set at https://www.mydomain.com(.au) - Zencart is in the root, not in a folder

Funtioning yes. Does it make me confident to buy from your store. No. Aside from the certificate being in another domains name which I agree is stupid and have raised with GetMomma, are there any other reasons that would not make you confident to shop in my store? I will be deleting the certificate for this domain, even after having gone through 3 days of utter pain and the site down :(

Firstly, there is no evidence to suggest shoppers will leave a site with no SSL. I agree - I have read a post in here by an internet security expert on the other side of the arguement and it makes logical sense ... but ..... It just so happens both sites have been producing sales without SSL certs.

Secondly, the tech savvy will avoid your site like the plague because your store name is "www.jewelleryonlinestore.com.au" but the SSL certificate is issued to
"harmonyballpendants.com" (which I assume is your other store). No matter, the fact that the Certificate doesn't match the store should raise alarm bells to anyone that visits (and most web browsers). You are better off without a certificate than you are to have one for what is apparently a different store. Agreed

If they checkout with PayPal express, and assuming by 'secure' you mean 'encrypted during transmission', then Yes (they will be using PayPals SSL, rather than yours).
If by 'secure' you mean that no one can gain access to their data after the order has been placed, then the answer is No (SSL can never provide such security).

If you have another definition of security you'll need to specify what you mean before I can provide an answer.

Does a Site with one domain name using a certificate for a totally different site make me feel 'secure' about conducting business with you. No. Not at all.

It a bit like have two watches. With one watch you always know the time. With two watches you can never be sure which one is accurate. :)

Your HTTPS server settings in the config files are incorrect. (my 1st guess) - mine also - see settings below and let me know what is incorrect.

Shhhh. Don't mention that name around here.. Many folks will ignore your pleas' for help. I actually just moved JewelleryOnlineStore.com.au from an Australian host (because they were hopeless - no cPanel - and over $10/month) and there were DNS issues that lasted 4 days so Google couldn't crawl the site and as a result the site dropped from SERP #1 for its secondary keyword and 14 for its primary keyword (tough competition) into oblivion. At first I suspected I got hit by Penguin but have now discounted that.

Generally not. With GoDaddy, nothing surprises me. I haven't had any issues to speak of with them so far (he says with finders crossed)

Cheers
Rod

admin/includes/configure.php settings;

• If you desire your entire admin to be SSL-protected, make sure you use a "https:" URL for all 4 of the following:
  */
  define('HTTP_SERVER', 'http://www.harmonyballpendants.com');
  define('HTTPS_SERVER', 'https://www.harmonyballpendants.com');
  define('HTTP_CATALOG_SERVER', 'http://www.harmonyballpendants.com');
  define('HTTPS_CATALOG_SERVER', 'https://www.harmonyballpendants.com');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

includes/configure.php settings

define('HTTP_SERVER', 'http://www.harmonyballpendants.com');
define('HTTPS_SERVER', 'https://www.harmonyballpendants.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_CATALOG', '/');

jewelleryonlinestore.com.au is as per above also

cheers,
Mike

gilby:

Check SSL Cert

Personally I would have got two certificates .
one for each store.
Rather then have them lumped together like this in one cert.

You are probably right Gilby - in hindsight I should have paid the extra money. The certificate I have is a UCC type which allows 5 domains (primary plus 4) and it is my intention to be launching some more eCommerce (ZenCart) sites soon - so being miserable with pennies I suppose. Lesson learned (the hard way) :smile:

I want to try to make shoppers feel comfortable from word go (those that are not savvy regular online shoppers - we get a lot of them) by having a statement not unlike what I have done on the home page of the site in my signature.

After going to that link you put in your post I am just wondering if replacing that certificate code in the sidebox with the link that you used would suffice for those who may wish to use it ....... your thoughts ??

cheers,
Mike

If you goto http://www.harmonyballpendants.com and place the cursor over login
It shows https://www.harmonyballpendants.com
Clicking on that link works fine for SSL

If you goto http://www.jewelleryonlinestore.com.au and place the cursor over login
It shows http://www.jewelleryonlinestore.com.au
Note that it is NOT https

This indicates to me that what is saved in includes/configure.php is
define('HTTPS_SERVER', 'http://www.jewelleryonlinestore.com.au');
and NOT
define('HTTPS_SERVER', 'https://www.jewelleryonlinestore.com.au');

Also check that define('ENABLE_SSL', 'true'); is indeed true and NOT false

Hiding under a rock here .... looking for the "embarrassed" emoticon. So much for double checking - JewelleryOnlineStore was indeed set to false. A result I think of working on the same thing on two sites at the same time - too many same name files all over the place.

Thanks for the wakeup call, I needed it.

cheers,
Mike

Gilby and RodG - thank you both for steering me in the right direction.

Totally off topic, sorry, but seeing as both you guys are in Oz maybe you can put a fellow Aussie on the right track. Do either of you have any experience with ZC with Affiliates?? I have left a couple of posts in Snap Affiliates and Multi-Site support threads trying to get a good clear picture of how best to achieve a good Affiliate program using ZeCart and the 2 plugins mentioned. Each thread seems to concentrate of specifics of issues but there is little written in the threads or in the add-ons info files or in FAQ's about the bigger picture - how all the pieces fit in the puzzle from a Marketing viewpoint (I have products others want to sell so how can this be achieved efficiently and for 2012, i.e. not just a picture and a link).

Anyway, pointing me in the right direction to a good source in this area would be helpful.

p.s. RodG - I will be installing your OzPost plugin soon, it looks great, just what we need. Already using some of your plugins Gilby - good stuff (especially TimeZone Fix - I was getting gazillions of error bug messages clogging up my cache to a stage at one time of not allowing me access to my database - now all is good)

shags38:

Hiding under a rock here .... looking for the "embarrassed" emoticon. So much for double checking - JewelleryOnlineStore was indeed set to false. A result I think of working on the same thing on two sites at the same time - too many same name files all over the place.

Thanks for the wakeup call, I needed it.

cheers,
MikeThis is the one you need :oops:

I can't help with the Affiliate program as I have never used one, sorry

shags38:

Do either of you have any experience with ZC with Affiliates??

No. none at all.

Pop SSL Quiz. (open to all)
Take a look at the following image:

People are being advised to 'look for the padlock' to check a sites 'security'. Can you spot the padlock in this image? If you knew nothing about this site and was visiting it as a customer would you think it was any more 'secure' than a site showing the following:

How many of you upon seeing the first link provided, would think to click on the square box to check the sites' authenticity? How many of those people (which will be very few in number) will stay on the site knowing that the certificate doesn't match the domain name? I'm not even game to guess the answer to this one, but I'm willing to bet that the number of stayers (those asking to be scammed) will be greater than those that would leave the site? (even though in this case it IS a legitimate site).

Sorry Shags38, it's not my intent to single your store out like this, but it just happens to be a convenient example of the many thousands of similarly setup sites that clearly shows two of the 'flaws' of SSL and current day usage. (1) The inability to easily identify if a site has SSL or not, and (2) the total lack to provide any confidence of authenticity of the sites they visit.

I will also reiterate that I'm not opposed to SSL, but I am forever being frustrated over the fact that SSL leads to a false sense of security because people simply don't understand it (What it does vs what it was designed to do).

Cheers
Rod

Rod - couldn't agree with you more and I have no problem in you using my site as an example. This kind of comment/information is what is lacking in the Tutorials section of ZC - not enough earthy explanation of what modules/plugins/add-ons actually do, their benefits vs pitfalls etc.

Maybe you should write an SSL information sheet(s) and submit to ZC for inclusion as an addendum to the FAQ relating to adding SSL to ZC. I'm sure it would help educate a lot of users - you have certainly helped me.

cheers,
Mike

UPDATE:
I have had detailed discussion with GoDaddy and am now much the wiser. UCC certificates are really only designed for primary domain and its sub-domains, not other totally different domains because the certificate will only show the primary domain, that is not an issue with subdomain.primarydomainwithcertificate .com but is absolutely useless with otherdomain.com.

I may let the administrators know so they can maybe add something to the FAQ or create a sticky or something to help avoid others being trapped.

cheers,
Mike

P.S. I was barking up the wrong tree as it turns out right from word go, sorry for the trouble guys - the blue SSL secured indicator bar isn't meant to show on the home page, only when logged in or having typed in the https address in the first place :blush:

shags38:

Maybe you should write an SSL information sheet(s) and submit to ZC for inclusion as an addendum to the FAQ relating to adding SSL to ZC.

I'm sure I haven't taught the team members anything they didn't already know. In fact they are probably have more advanced knowledge of PCI requirements than I do, especially in regards to eCommerce sites.

shags38:

I'm sure it would help educate a lot of users - you have certainly helped me.

Sadly, it will also confuse a lot of users. ZenCart already has a rather steep learning curve, and the topic of SSL and/or PCI compliance isn't strictly Zencart related. The same rules and conditions apply regardless of the store software being used, so on this basis it doesn't belong in the Zen FAQ files.

Cheers
Rod

Cheers Mate - what part of Oz?

by the way I think I have a cream for that rash on your face :laugh: