Forums / Templates, Stylesheets, Page Layout / SSL Settings in admin/includes/configure.php

SSL Settings in admin/includes/configure.php

Locked

Started by maineiac13 on 18 Oct 2008, 12:01 AM · Views: 4,693

Results 1 to 2 of 2
This thread is locked. New replies are disabled.
18 Oct 2008, 12:01 AM
#1
maineiac13 avatar

maineiac13

New Zenner

Join Date:
Sep 2008
Posts:
98
Plugin Contributions:
0

SSL Settings in admin/includes/configure.php

I just went through the tutorial about setting up SSL and it seems to be working fine. However I have a question about the settings for admin/includes/configure.php. After setting the proper https information for HTTPS_SERVER and for HTTPS_CATALOG_SERVER the next lines of code read:

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'false');
define('ENABLE_SSL_ADMIN', 'false');

At this point I have not changed either of those from 'false' to 'true' in the admin/includes/configure.php file...though of course I changed the ENABLE_SSL from false to true in the includes/configure.php file. And as far as I can tell my website is running fine.

Can anyone explain what is gained/lost by changing either or both of those items from false to true in the admin/includes/configure.php file?

Thanks

18 Oct 2008, 12:19 AM
#2
kuroi avatar

kuroi

Totally Zenned

Join Date:
Apr 2006
Location:
London, UK
Posts:
10,475
Plugin Contributions:
11

Re: SSL Settings in admin/includes/configure.php

What is lost is that none of your communications with your Admin would be encrypted, in particular login, so you would risk somebody sneaking a look at your Admin password and gaining access to your customer data.

And links embedded in some customer emails, in particular those involved in the order processing process, would encourage customers to access their accounts in a non-secure way.

I'm not sure that anything is gained, except perhaps an almost inperceptible increase in the site's speed.

Kuroi Web Design and Development | Twitter

(Questions answered in the forum only - so that any forum member can benefit - not by personal message)