SSL Certificate Problem

Hi,

I am just writing to ask for some advice regarding our new SSL certificate.
We had a thawte SSL certificate installed to protect our websites checkout and login pages. Our developers copied our site into the httpsdocs directory on our server, however, now when a user moves through the pages on our checkout they are met with a security warning at every move:
"Security Warning - Although this page is encrypted, the info you have entered is to be sent over an unencrypted connection and could easily be read by a third party"

I'm really concerned about this and our web developers don't seem to be able to fix it.
I paid the technical team from our hosting company to have a look over the problem to see if they could fix it. This was their response:

"Normally this wouldn't be a problem - Zen Cart has a simple yes / no switch to set whether it should use ssl for protected pages or not, but it would seem that someone has been messing around with this and broken it."
"Regarding the SSL, there is a FAQ on the Zen Cart site here
https://www.zen-cart.com/tutorials/index.php?article=14
that describes how to set up a SSL, however the steps described in this had already been done. As I said yesterday, unfortunately because the code has been messed around with the SSL bit is broken. Due to the use of this Zen Cart, it will take far longer than the originally proposed 2 hours to attempt to fix this - indeed I would say that it would be quicker to re-install it from the Zen site. I'm guessing this is why your developers were reluctant to make the changes themselves."

I'm really at a loss as what to do to fix this. Our developers don't seem to know what they are doing.
My website is www . littlescruffs . com
I would be so so grateful if anybody could offer any help. We would also be very willing to pay someone with the technical inclination to get this sorted for us.

Thanks for the help

If you want somebody to look at this, I recommend that you create a test account through which people can access your checkout. Has the extra benefit of helping you to differentiate between people interested in your products and those offering technical help.

It always bothers me to see> Our developers copied our site into the httpsdocs directory on our serverESPECIALLY when it's not followed by> and they made the required changes to both configure.php filesYour cart was set up somewhat automatically in that Zen Cart searches for its current setting an builds the configure.php files with that info. Any directory change must be reflected in the configure.php files or strange things will occur.

Would it be correct to say the problem has been solved?

Using either FF or IE 8 to view your 'https' login page shows no Warnings at this time.

littlescruffsDOTcom/index.php?main_page=login
Still dies when clicking on sign up

dbltoe:

littlescruffsDOTcom/index.php?main_page=login
Still dies when clicking on sign up
You need to include www

Website Rob:

Would it be correct to say the problem has been solved?

Using either FF or IE 8 to view your 'https' login page shows no Warnings at this time.

No I'm afraid this hasn't been solved.
I've set up a test account so anyone can log in to our checkout and see these error messages:
Email. [email protected]
Pass: test123

Our developers just don't know what they are doing! I keep harrassing them to get the problem sorted and they now simply send me links to Zencart FAQ pages telling me how to set up my own SSL!!
I feel they have left me in a big mess and if I had the technical ability to do all of this myself, I wouldn't have paid the developers to do this for me.
I know something is very wrong, but if anybody has a possible solution or is able to fix this (for a fee of course). I would be very interested to hear from them.

Thank you very much

It looks to me as though some of your page templates have been changed and in making these changes the security that should apply to some of your pages has been lost.

But others work fine, which shows that it's not the SSL certificate or it's installation that's at fault.

Rather I suspect that your developers have altered links and form submissions in ways that negate the way that Zen Cart makes sure that the pages that need to be secure are.

The ones that leapt out at me were the login page, but much more importantly than that the form that submits payment information is submitted to an http link instead of https. In other words your customers credit card details are being sent unencrypted, even though you have SSL installed.

This is probably going to be because they have made changes to the relevant page templates and either not used, or messed up the Zen Cart form and link functions. But unfortunately we can't see this from the pubic side of the site.

You could test this by switching back to the classic template briefly and seeing whether the problem goes away. If it does, it's restricted to the template level, if it doesn't they it's as a result of deeper changes.

As an aside however, I strongly recommend against hosting arrangements that require a duplicate of the site in an httpsdocs or similar. Having to keep both versions in sync is a challenge just waiting to go wrong.

Could you please post the relevant lines in your includes/configure.php and admin/includes/configure.php files (minus any sensitive info).

Alternatively PM me with a copy of the files (minus any sensitive info).

Thanks,

I'm sorry to sound a bit naive, but how would I go about switching to the original template so I can see where these problems lie?
I will disable the card payment option on our site until this is sorted.

Thanks

Admin > Tools > Template Settings

kuroi:

...
As an aside however, I strongly recommend against hosting arrangements that require a duplicate of the site in an httpsdocs or similar. Having to keep both versions in sync is a challenge just waiting to go wrong.

That's the bit which bothered me in first place. Really, nothing should have to be duplicated in the process of installing a simple SSL cert :shocking:

Someone doesn't seem to know what they are doing ....

frank18:

That's the bit which bothered me in first place. Really, nothing should have to be duplicated in the process of installing a simple SSL certThis is the "secure vault" approach to security.

It can work for small sites where what needs to be secured is self-contained, but next to impossible to use as intended for a sophisticated app like Zen Cart where each page is built from many components most of which are shared by secure and non-secure pages.

frank18:

Could you please post the relevant lines in your includes/configure.php and admin/includes/configure.php files (minus any sensitive info).

Alternatively PM me with a copy of the files (minus any sensitive info).

Hi there,

Thank you for your reply with regards to my SSL problem.
I am able to access my files through the FTP, however, I'm not sure what the relevant lines are that you would need to look at.

I am able to log onto the FTP, I then choose:

Webspace
httpdoc
includes
configure.php

Nothing appears! It is as if there is nothing in this folder.
It is exactly the same if I choose httpsdoc instead of httpdoc

Just re-read your original post and realised that I am agreeing with this > "Normally this wouldn't be a problem - Zen Cart has a simple yes / no switch to set whether it should use ssl for protected pages or not, but it would seem that someone has been messing around with this and broken it."Though this switch is actually an SSL / NONSSL setting and is set on each link in a template (often by default) either standaline or as part of a form action.

kuroi:

Admin > Tools > Template Settings

I have just briefly switched to the 'classic green' template and the same security message still appears.
This warning message was visible at the top of every page on the site:

Warning: I am able to write to the configuration file: /usr/local/pem/vhosts/100375/webspace/httpdocs/includes/configure.php. This is a potential security risk - please set the right user permissions on this file (read-only, CHMOD 644 or 444 are typical). You may need to use your webhost control panel/file-manager to change the permissions effectively. Contact your webhost for assistance.

LittleScruffs:

Hi there,

Thank you for your reply with regards to my SSL problem.
I am able to access my files through the FTP, however, I'm not sure what the relevant lines are that you would need to look at.

I am able to log onto the FTP, I then choose:

Webspace
httpdoc
includes
configure.php

Nothing appears! It is as if there is nothing in this folder.
It is exactly the same if I choose httpsdoc instead of httpdoc

/usr/local/pem/vhosts/100375/webspace/httpdocs/includes/configure.php

that's one of the files I am looking for

Hmmm..... could you ask your developers to email you a copy of the two configure.php files?

I have asked them to email me a copy, but I'm not sure when I will receive them, hopefully Monday.
Thanks

Just as a matter of interest.
Does anybody know of a trusted company/person who would be able to carry out the alterations to fix our problem?
I have lost a lot of faith in our developers and am unsure if any work done by them would just make our situation worse!
I would be very grateful for any recommendations so I can try and get this problem sorted.

Thanks

LittleScruffs:

I have asked them to email me a copy, but I'm not sure when I will receive them, hopefully Monday.
Thanks

That's ok. Got your PM as well