SSL Admin logs out

When I configure my site to use SSL for the admin login, I am able to log in successfully but when I select any item from any of the admin menus, I am returned to the admin login page and have to log in again. This happens every time I log in.

I have looked at the web space error logs and there is nothing reported in there. The server is Linux / apache.

If I reconfigure my site to disable SSL for the admin login, everything works fine and I can log in and select any item from the menus without any problem.

Does anyone have any suggestions why this might be happening or where else I can look to try and debug this?

TIA

Paul

I had the EXACT same problem! You are using shared SSL cert. - DONT! Zen Cart doesnt like it. Do yourself a favour and buy one I saw some on that GoDaddy today for like less than $30- Save the heartache and get your business properly protected with 256 bit dedicated SSL cert. :smile:

While I do recommend buying a secure certificate ... Zen Cart works fine with shared certificates when they are setup correctly ...

Are you able to login/create account on the Catalog? And can you then navigate back and forth between the secure and non-secure pages? :unsure:

Dear Ajeh,

There IS a real issue with shared SSL. There are many posts dotted all over about this "login loop". I tried really hard for 2 days reading through the forums and googling this issue and working closely with my webhost, that have AMAZING support which is totally dummy proof, still I only managed to dig up more dust on the issue and it wouldnt go away. :blink:

http://www.zen-cart.com/forum/showthread.php?t=164477

I really did want to save the money :P but in the end of the day I felt that if there was one place I might as well spend a little it was security :smartalec:

Maybe its time for a detailed look at the issue of this login loop, the root causes and writing a thorough guide on the issue. I would do it myself ofcourse, and not suggest even more work for you, if only I had 1% of your technical knowledge, which I obviously don't.:unsure:

The only time the shared SSL does not work is when:

1 it is not setup correctly by the Hosting provider

2 Browser issues usually, old/bad cookies, cache etc. from trying to get it setup correctly

I, and the rest of the team, have used shared SSL on a zillion sites without a problem ...

Again, we do prefer proper dedicated secure certificates, but it is not a requirement to use Zen Cart in a secure environment ...

Thanks for the pointers but I did actually buy my own SSL certificate. It was working correctly when I first installed Zen cart but has since stopped working correctly.

I haven't yet tried to set up a test customer account to see if SSL works from thatside.

Perhaps one thing I should add - my ISP set up a separate web space and domain for the SSL to work so a link had to be created to the store location from the SSL secure folder. However, this did seem to be working correctly when it was first set up.

Any ideas?

Thanks

Paul

Check your Catalog and if the secure pages work right ...

If so, if you could post the files from the server, without your username, password or secret /admin directory name:
/includes/configure.php
/admin/includes/configure.php

we can peek and see if you have configuration issues ...

I have now tried using a test account and the SSL appears to be working for normal users. Using Firefox, I get a padlock icon when I go to checkout but it appears with a red exclamation over it and the message "Warning: Contains unauthenticated content" which I assume is because the page is a combination of secure and non-secure elements?

It looks like this issue is just with the site admin and it wasn't there when I first installed 1.3.9a. It seemed to appear after one of the subsequent patches. I'm now patched up to 1.3.9g

Any ideas?

Thanks

Paul

I've attached the config files. Let me know if you spot anything!

Thanks for your help

Paul

Dear Paul

I also will be real keen to know how you solve this,

best of luck :smile:

These need to match:

define('HTTP_SERVER', 'http://www.my-domain.com');
define('HTTPS_SERVER', 'https://my-domain.com');

If your secure certificate is for WWW use: www.your_domain.com

otherwise use: your_domain.com

The same with these:

define('HTTP_SERVER', 'http://www.my-domain.com');
define('HTTPS_SERVER', 'https://my-domain.com');
define('HTTP_CATALOG_SERVER', 'http://www.my-domain.com');
define('HTTPS_CATALOG_SERVER', 'https://my-domain.com');

Ajeh:

These need to match:

If your secure certificate is for WWW use: www.your_domain.com

otherwise use: your_domain.com

The same with these:

My store is installed at https://www.my-domain.com and my SSL certificate and the secure folder are both my-domain.com so to achieve what you suggest I would have to move the entire website and shop to the my-domain.com domain instead of the https://www.my-domain.com domain. Or the other alternative would be to buy yet another SSL certificate for the https://www.my-domain.com domain.

Have I understood this correctly?

Surely the software should support the dual domains for SSL and non-secure areas? if not, why have two variables? As I mentioned previously, it did work when I installed 1.3.9a so I don't understand why now you're telling me now it won't work? Especially when it does appear to be working for customers / checkouts. I appreciate the set up I have might not be the optimum solution but possible, I would prefer not to have to buy another certificate just to fix the admin issue.

Thanks again.

Paul

I am suggesting that you need both of your configure.php files using the same settings and that they match your secure certificate ...

If the secure certificate is for: www.your_domain.com ... then use:

define('HTTP_SERVER', 'http://www.your_domain.com');
define('HTTPS_SERVER', 'https://www.your_domain.com');

define('HTTP_SERVER', 'http://www.your_domain.com');
define('HTTPS_SERVER', 'https://www.your_domain.com');
define('HTTP_CATALOG_SERVER', 'http://www.your_domain.com');
define('HTTPS_CATALOG_SERVER', 'https://www.your_domain.com'); 

If the secure certificate is for: your_domain.com ... then use:

define('HTTP_SERVER', 'http://your_domain.com');
define('HTTPS_SERVER', 'https://your_domain.com');

define('HTTP_SERVER', 'http://your_domain.com');
define('HTTPS_SERVER', 'https://your_domain.com');
define('HTTP_CATALOG_SERVER', 'http://your_domain.com');
define('HTTPS_CATALOG_SERVER', 'https://your_domain.com'); 

These need to match ...

So what you're saying is for a website at https://www.my-domain.com and a SSL certificate for my-domain.com the software no longer works?

My configuration files do reflect the way my site is set up (even though this does't appear to ideal by zen cart standards!).

It still doesn't answer the question why there are two variables if the only workable configuration is to have them identical anyway:dontgetit

As it does work with the normal user checkouts etc. I guess I will either have to live with a non-SSL admin login (which I guess I don't lose much as the rest of the admin is non SSL anyway) or I bite the bullet and buy another SSL certificate as that would be simpler than having to move everything.

Maybe I will live with it as it is until I need to renew the certificate and next time I buy one that allows the simpler configuration!

Thanks for your help.

You need to have them the same ...

If you want www use www on all of them ...

If you do not want www don't use www on any of them ...

Ajeh:

You need to have them the same ...

If you want www use www on all of them ...

If you do not want www don't use www on any of them ...

Hi there. I have been following several threads on here about SSL. Currently our host is Yahoo and they offer a shared ssl certificate. Because we are a new store, I believe it is in our best interest to start out with the shared. I did read a posting somewhere that said it was recommended to copy the entire catalog folder into the ssl folder that yahoo asks us to create to insert our pages we want secured. The post also mentioned keeping the files in the original folder. Now this is gonna be a really silly questions, but once they are moved over to the ssl folder and everything works fine, I won't have any need for the duplicate folder correct?

Yahoo is not a good solution ... but that is just me ... coughand a bazillion otherscough

If you need to copy your files to the secure directory you need to:

1 copy all files

2 maintain a duplicate set at all times

You would really be better off getting a proper hosting provider ... even with a shared certificate to start, at least you will be on a hosting provider that is designed for managing an ecommerce site ...

Peek at our Certified Hosts and consider one of them ...

Ajeh:

Yahoo is not a good solution ... but that is just me ... coughand a bazillion otherscough

If you need to copy your files to the secure directory you need to:

1 copy all files

2 maintain a duplicate set at all times

You would really be better off getting a proper hosting provider ... even with a shared certificate to start, at least you will be on a hosting provider that is designed for managing an ecommerce site ...

Peek at our Certified Hosts and consider one of them ...

Thanks for your input. I will look into the certified hosts. Have there been major issues with Yahoo or is it just a personal preference?

paul-h:

So what you're saying is for a website at https://www.my-domain.com and a SSL certificate for my-domain.com the software no longer works?.....

If your SSL certificate is issued for my-domain.com then it will not work if your defines in the configure.php files are set for https://www.my-domain.com and vice-versa.

This applies to a dedicated and to a shared certificate.

See Ajeh's post #15 in this thread.

paul-h:

....Maybe I will live with it as it is until I need to renew the certificate and next time I buy one that allows the simpler configuration!.....

If I was you I would get a dedicated certificate quick-smart. Having an unsecure checkout will cost you sales. These certificates are not expensive at all. Shop around and you can get a dedicated cert (eg GeoTrust) for 50-60 bucks per annum. One or two sales would pay for that expense.

Trice:

Thanks for your input. I will look into the certified hosts. Have there been major issues with Yahoo or is it just a personal preference?

A search of the forum on Yahoo will give you an idea of the heavy jeeves that it gives me ... :blink: