Suddenly getting SSL Security Warning

I have 6 images that are calling this warning when a customer tries to log in.

Yes, I have read all of the related threads about this that I could find. yes, I understand that I am supposedly having this problem because of how something is calling to a some of my images.

What I don't understand is why this was working fine a week ago and now its not. And I have looked through my codes and cannot find anything that is hard coded to these images. Totally confused by now. Thanks for any help.

**** removed URL ****
it happens when you click Log In at the top of the page.

Who is your hosting company?
It appears as though they've changed something in the configuration of the shared-SSL certificate you're using, or how the server handles SSL, and now Zen Cart is no longer able to detect that the visitor is on an SSL page.

You can see proof of this by clicking your login link, then right-clicking in your browser and choosing "View Source", and look at the <base href=xxxxxxx> tag. That xxxxxx value will automatically change to your https (SSL) address if the server is properly configured. If it shows your http address instead, then the server's SSL isn't properly configured.

You need to log a ticket with them.

DrByte:

Who is your hosting company?
It appears as though they've changed something in the configuration of the shared-SSL certificate you're using, or how the server handles SSL, and now Zen Cart is no longer able to detect that the visitor is on an SSL page.

You can see proof of this by clicking your login link, then right-clicking in your browser and choosing "View Source", and look at the <base href=xxxxxxx> tag. That xxxxxx value will automatically change to your https (SSL) address if the server is properly configured. If it shows your http address instead, then the server's SSL isn't properly configured.

You need to log a ticket with them.

Thank you! I KNEW that was the problem in some way or another. I already opened a ticket with them but they insisted it was on this end. Now that I have your info to share with them, hopefully they will get this fixed for me.

Again thanks!

Can you tell me if you think it is possible that this could have anything to do with a change in PHP? That's the only thing that has really changed that I know of and they are tellling me that there has been no changes in the shared cert on their end.

PHP change, maybe.
Apache change, definitely.

I really hate having to teach hosting companies how to configure their servers. Especially when it comes to SSL. If they can't do it right, they ought not to be doing it in the first place.

This post has a tool they can use to keep testing things to determine when they've fixed the problem they created: http://www.zen-cart.com/forum/showpost.php?p=935687&postcount=4

Is that something that I can use too? Can I try it before I send it to them, or could I mess up something with it?

Thank you!

You can certainly try it yourself.

If it's working properly, when you access it using an https URL it should say Protocol: SSL. Otherwise it'll say Protocol: NONSSL.

I might suggest putting the file in your /extras/ folder, and maybe giving it a slightly different filename, just so snoopers don't go using the file and gleaning information about your server that they've got no business knowing.

Or I could just delete it when I am done? I usually dont leave stuff like that on my server.....

katco:

Or I could just delete it when I am done? I usually dont leave stuff like that on my server.....

most definitely ... it should never be left on the server
use it only when needed

Several hours later, here is their reply to me:

"Thanks for your patience, I have been checking into your issue but I could not find any reason for this issue to happen due to php version change. The warning clearly tells that SSL is there but it can't encrypt some to the contents. As mentioned earlier if you use some hard coded URLs without https then such issues arise.

On the other hand there has not been any change in SSL settings. I have confirmed that shared SSL is installed and is working fine for Apache and all other services."

This was after it was escalated to 3rd level support.

I really do not believe I have any hard coded images, but just to make sure I am not wrong, how would a person check for that? I used my developers toolkit to find those images and nothing that got sent back to me on that search showed it. Is it possible that they could still be there even though I searched with the tookit?

I just do not know what else to look at or what to do.

No, you didn't hard-code images.

The problem is that since the server's configuration doesn't expose that it's running in SSL mode, Zen Cart is unable to detect it despite trying all the conventional means.
And as such, Zen Cart is rendering page content as if it were non-ssl ... which is why you're getting the security warnings.

If the server administrator fixes the server configuration problem they created last week, all your secure-warning problems will go away.

They are saying there were no server configuration problems or changes. I suppose it does not help that I cannot pinpoint the exact time the problem started.

I wish I knew what to say to them to convince them its on their end, but they don't believe me.

So, do I have to completely delete my store and start over? Is that my only option? Or will the problem still exist even if I do that?

Do you know for a fact that I didn't hard code any images? I'm just asking because if I could prove that to them somehow, maybe they would look at it differently.

Deleting your store won't help.

You did say it was working just fine a couple weeks ago, right? And then they made some changes, right?

What did they say about the ssltest script I pointed you to? Surely they're not going to just wash their hands of it and say it's not their problem, when the code that does that detection within Zen Cart has not changed during the time that their server's functionality suddenly changed.

No. I did say it was working a few weeks ago. And then yesterday and today there was some changes to the PHP on my server. But as far as any other changes, I have no idea if they made changes or not.

I don't know if they used the test script or not. I did tell them about my results, but apparently they don't believe them or think that its my images that are causing that response.

I have been with these guys forever and have never had any problems like this with them. So I am super frustrated by this point that I cannot seem to convince them its on their end.

If your Zen Cart software and site content haven't changed, but changes have been made to the server's main configuration settings, and suddenly a problem started, the wildcard is the server configurations, not your Zen Cart software.

The php changes were to my end.... I have both php 4 and 5 scripts so we set it up so I could run 4 where needed and 5 where needed. At this point I really dont know if there was any changes made to that directory or not.

I am unaware of any other server changes... there may have been some or there may not have been. I am trying to recall if I have made any zencart changes to that particular site, but being as how i manage about 17 zencart stores, its hard for me to recall everything. I am quite sure I didnt do any image changes, but hey, maybe I did. That is why I was asking about how I could double check my images to be sure.

Well, you can certainly double-check all your images if you want.
But until your server is capable of sharing the required details so PHP can see that it's operating in SSL mode, you won't be able to test much.

Aside: Have you considered using a proper dedicated SSL certificate instead of a shared one?

So, what I was asking earlier is: How do I double check my images besides searching them through the developers toolkit?

Yes, I have thought about that... but I already have other non shared ones. Prices add up. But, if I switched to one, would it fix the problem? because if so, I would do that.

A dedicated SSL is unlikely to do anything with this situation, other than make your hosting company deal with yet another SSL factor.
It's just a good thing to do.

As for double-checking your images, etc, search your site for any hardcoded tags that say src="http: anywhere in your site. More specifics here: https://www.zen-cart.com/tutorials/index.php?article=150