SSL Problem (Base href???)

Hi there,

Could someone please look at http://www.hairrigs.com ?

I've just installed SSL but I'm getting errors saying that some items are not secure. It appears that (for starters) all the CSS is not secure because just prior to the stylesheet lines in the code there is...

configure.php looks like this...
// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com
define('HTTP_SERVER', 'http://www.hairrigs.com');
define('HTTPS_SERVER', 'https://www.hairrigs.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

Certificate is issued to http://www.hairrigs.com

Any ideas anyone??

Thanks,
Dave

Zencart will only invoke SSL when there is a need for it... Such as when people send personal or payment data over the internet. SSL slows a site down, so you don't want SSL all the time.

If you are getting "This page contains insecure elements" warnings, it means that when it is in https mode, the page has links in it that are not https.

Generally, these occur when you hard-code hyperlinks, or call a url into a page which is absolute and http.

When the warning appears, it will ask you "Do you want to display these elements?"

Choose "NO"... and you can then inspect the page for the problem URL's and decide on your course of action with these links.

Hi there,

Thanks for your reply. I understand the bits you mention and I don't have SSL on the whole site, just the checkout pages etc.

I've already determined that it's the CSS that is not secure as it's being called as http:// rather than https:// due to the base href command before the stylesheet lines.

Any ideas?

Cheers,
Dave

Your stylesheet is probably the ONLY correct link on the login page.
Most all the others are hard-coded. No matter what you do to those, the Google link will continue to bomb the ssl.

I see we have a new contender in the messed up template category. TM meet Acadame:(

Uh-oh, that doesn't sound good. What's TM?

Could you suggest which files I need to start editing to put things right? Is it just a case of changing the links from absolute to relative?

Looked at the files and I see it's not as simple as I thought....

Ditch Acadame or learn php? :cry:

There are so many things:blink:
TM is template monster and it appears your template is trying to join them in manipulating code that looks great till you need to make the slightest adjustment. In TM's defens, I've never seen the absolute links in their log in pages.

First clue of problems (to me), is the Log Off and My Account links which (in real Zen Cart) wouldn't show up till I was logged in to the site.:wacko:

Try backing out of this template to the classic template and see what happens with the ssl. My guess is you won't see any absolutes in the page source (with the possible exception of the Google link mentioned before)

Ah Template Monster... that makes things worse, I had just started to think that at least I can buy a Template Monster template if I can't get acadame to work..... it was going so well until this too!

Thanks for your help, i'm going to have to have a think on this one...

The "things we've done" in my sig were done in the stylesheet and using our own graphics. One of them is a free template that we modified slightly. You might even find one you can modify at Kuroi's (sorry, site offline)

Thanks, I'll check the links out when I finish banging my head against the wall....

Still struggling, back to default template but something still causing trouble. Am I right in saying that links to non-ssl pages are ok, for example

That's just standard zen cart right?

I have this dubious line

getFile("http://www.hairrigs.com/javascript_check.php?zenid=014d7e471190fbf3157f026ac9b4d053");

Think that's part of fast and easy checkout but not 100%...

:censored:

PS: the my account and log off links were put in by me with an easy page as they weren't showing at all, so acadame not entirely to blame there!

there should not be any cart links that start with http://. That would automatically take it out of ssl.

Hard to tell without looking at your site. do you have any mods installed?

Yeah, a few mods. Simple SEO Urls, fast and easy checkout, google base feeder, google checkout, google analytics.

I backed up after each modification (but didn't have my SSL installed until the end) so I'm going to restore each backup to another domain starting with the first and try to work out where it all went wrong.....

Totally confused now....

Just done a fresh install (to http://www.hairrigs.com again)

still getting the SSL problems and still seeing

in the source.

Why doesn't my fresh install put

instead?

:frusty:

What do you have in your .htaccess file?

Totally fresh install, so no .htaccess file in web root.

Just been in touch with my webhost who say it's the way their SSL is set up. PHP isn't detecting the fact that the pages are SSL.

They have given me a couple of options and are going to make some changes at their end I think.

Will post again if there are any other problems related to this.

DaveS:

Just been in touch with my webhost who say it's the way their SSL is set up. PHP isn't detecting the fact that the pages are SSL.

They have given me a couple of options and are going to make some changes at their end I think.

Will post again if there are any other problems related to this.
It's probably the way how their SSL is set up, and as I vaguely remember DrByte also posted a temporarily fix somewhere, but it's the best if your host can fix it on their end.

Thanks!

They have suggested just removing the base href command initially and if that doesn't work they have a more complex fix.

Will have a look for DrByte's solution too.

DaveS:

Thanks!

They have suggested just removing the base href command initially and if that doesn't work they have a more complex fix.

Will have a look for DrByte's solution too.

If you remove it, you wont be able to use any module that modify your urls, also, you may have other problems down the road. It's their problem, make them fix it. They have to fix it.

OK, thanks for that info - that will save me more headaches when I try to put all my modules back on.

Will contact them and see what they say.

Cheers,
Dave