URGENT: Customers are being forced to log in again and again

My website URL is http://dmsmerchandise.com

When customers click on images, it is taking them right back to the log in screen. This appears to be even worse if they log in from AOL.com. You may want to log in as a customer and take a look at what is going on and see.

This effectively shuts my business down if I can't fix this bug. Anyone that has a solution, please email me quickly. Thanks.

Below is a typical complaint I am getting from customers:

"Doug,
I have tried to log in numerous times. It welcomes me, but when I attempt to click on any images to view the product, it takes me back to the log in screen."

Not a solution - but more info.. when clicking Log In (using firefox) I get an error page;

dmsoft-wy.com uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is unknown.

(Error code: sec_error_unknown_issuer)

My certificate is issued by Comodo so that is interesting.

Some info

Look at your header login link

https://  dmsoft-wy.com  /~dmsoftwy/store/index.php?main_page=login

This should be a relative link anyhow.

As far as the SSL it is not installed correctly.

~Melanie

Is it a new certificate? Was it working before? Do you have a shared certificate you could try? Have you changed the https settings in zencart config? Has your certificate expired?

s_t_e_v_e:

Is it a new certificate? Was it working before? Do you have a shared certificate you could try? Have you changed the https settings in zencart config? Has your certificate expired?

it appears you could change back to a shared ssl with bluehost?? until you get this sorted?

Certificate is not expired. It was installed by the hosting service. It works from my end and when I try to log on from AOL or another ISP, and on the computer at the office.

Internet explorer will not show your page.. firefox shows me a warning... I can allow a security exception to access your page... but no customer will be comfortable doing that...

I'm interested to see other comments...

Seems to be an issue with firefox and not others. AOL and MCIE both accept the certificate.

Did some more chaecking on Comodo's website. Below is their FAQ response:

One may get the following message when trying to navigate to a page when OCSP is enabled.
Error establishing an encrypted connection to http://ocsp.comodoca.com. Error Code: -8048.

This is a result of a bug in Firefox 2.0.0.x. It has been fixed in Firefox 2.0.0.15. Firefox 3.x was not affect by this bug.

Solution: Either disabled OCSP in Firefox 2 or upgrade to Firefox 2.0.0.15 or better. Mozilla strong recommends that users upgrade to Firefox 3.

What version of Firefox are you using? If you have MCIE you might try it because some of the modules I am using are optimized fo use with MCIE. Plus it would give me an idea if it's happening with other browsers. I am evaluating Comodo's SSL so any feed back on issues would certainly be appreciated.

Matters little what Comodo says about the error..... The certificate will not display secure pages in any of my browser's

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6

Secure Connection Failed
dmsmerchandise.com uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is unknown.
The certificate is only valid for the following names:
https://www.dmsoft-wy.com , dmsoft-wy.com

(Error code: sec_error_unknown_issuer)

• This could be a problem with the server's configuration, or it could be someone trying to impersonate the server.

  • If you have connected to this server successfully in the past, the error may be temporary, and you can try again later.

and

IE 7.0.5730.13

There is a problem with this website's security certificate.

The security certificate presented by this website was issued for a different website's address.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
We recommend that you close this webpage and do not continue to this website.
Click here to close this webpage.
Continue to this website (not recommended).
More information

If you arrived at this page by clicking a link, check the website address in the address bar to be sure that it is the address you were expecting.
When going to a website with an address such as https://example.com, try adding the 'www' to the address, https://www.example.com.
If you choose to ignore this error and continue, do not enter private information into the website.

For more information, see "Certificate Errors" in Internet Explorer Help.

and

Chrome 1.0.154.48

This is probably not the site you are looking for!
You attempted to reach https://www.dmsmerchandise.com, but instead you actually reached a server identifying itself as https://www.dmsoft-wy.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of https://www.dmsmerchandise.com. You should not proceed.

I think you need to look closely above at what Google and FF has to say in the error.

This certificate is installed incorrectly or for the wrong domain.... again it matters little what Comodo says as no one will shop at your store..... Just an FYI also, that you have accessed the site many time and have cached its IP and are probably NOT displaying the error as a result.... But until you posted I never have.

~Melanie

I just figured out the problem. Try the following path:

http://dmsoft-wy.com/store

The path http://dmsmerchandise.com is supposed to take you to the main page, but if you go to input personal data it is supposed to force SSL to https://dmsoft-wy.com. Something is not set right in ZenCart is my guess and I don't understand it.

I seriously doubt if Bluehost.com has my certificate installed wrong.

Did you read my post below.....

I told you about the domain..... And if they installed a certificate for another domain on your account then its installed incorrectly.... They would have had errors related to the DNS for the certificate from the beginning.... Unless you changed domains???

~Melanie

mprough:

Did you read my post below.....

I told you about the domain..... And if they installed a certificate for another domain on your account then its installed incorrectly.... They would have had errors related to the DNS for the certificate from the beginning.... Unless you changed domains???

~Melanie

You got it right on the button actually. My ORIGINAL doman when I had the SSL installed was http://dmsoft-wy.com. When I was brainstorming on "branding" my website more exact to what it is, I came up with DMSMERCHANDISE ONLINE and registered dmsmerchandise.com as another domain. The difference between the two is dmsoft-wy.com has it's root as the public_html directory whereas dmsmerchandise.com points to public_html/store as it's root.

The certificate is registered to dmsoft-wy.com is the domain the certificate is registered to. I know what the fix is now and that will be taken care of this weekend when I am going to puchase a certificate from Bluehost.com and have both domains protected under a SSL certificate.

For now I am going to change the root that dmsmerchandise.com points to so it brings up public_html/index.htm which is not part of zencart's modules. The store button on that page points to http://dmsoft-wy.com. At that pont the SSL should take over correctly. Thanks and yes I did read what you posted and agree with it. I was trying to point a secure connection to a domain that did not yet have SSL coverage on it.

Final word, thanks Melanie!!

I changed the root of dmsmerchandise.com to point at public_html/dmscherchandise/index.htm

From there (until I get the SSL certificate assigned to dmsmerchandise.com) I will use this method to preserve SSL security.

You SHOULD have no issues now if you click on dmsmerchandise.com and then on the "store" button.

Once here click login

Same error...

Because the link is

https://dmsof t-wy.com/~dmsof twy/store/index.ph p?main_page= login

instead of

https://st ore.dmsof t-wy.com/index.ph p?main_page= login

But.....

The subdomain you are using is not valid for the certificate either :no:

Secure Connection Failed
[B]st ore.dmso ft-wy. com[/B] uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is unknown.
The certificate is only valid for the following names:
  www.dmsoft-wy.com , dmsoft-wy.com  

(Error code: sec_error_unknown_issuer)
 * This could be a problem with the server's configuration, or it could be someone trying to impersonate the server.

    * If you have connected to this server successfully in the past, the error may be temporary, and you can try again later.

Well...I will remove the subdomains also. Thanks.

https://dmsoft-wy.com/

shows the same error message...

dmsoft-wy.com uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is unknown.
(Error code: sec_error_unknown_issuer)

Have you contacted bluehost?

dmm2020, before you purchase an SSL Cert you must first obtain a Dedicated IP for the Domain name. Right now you are using a Shared IP so no SSL Cert will work.

Also, all your Zen Cart links have "~dmsoftwy" in the URL which is incorrect. It needs to be removed from both your 'configure.php' files.

I should have dedicated IP, least I have been paying for it. What are you seeing to indicate you that it is not installed?