SSL certificate for admin area

Hello,

I have an SSL secured site, and have it activated in Zen Cart v.1.5 to protect the admin area as well. I did notice that when I go to the log in to admin area screen it is not included in the secured area.

Is there a setting that I can change to have this feature? I guess with things like the Guass virus out there I am thinking that it would be safer to protect the login and password to admin also.

Maybe just overkill, but I have been hacked before and am now cautious and aware.

If you could please let me know if there is an area to enable a feature like this, I would appreciate it.

Kind Regards,
Jeff
[email protected]

If you've properly updated your admin/includes/configure.php file to set HTTPS_SERVER and DIR_WS_HTTPS_ADMIN to correct URL/path settings and set ENABLE_SSL_ADMIN to 'true' then your login page will show up with that https URL automatically.

If you want to additionally secure ALL your admin pages over SSL, set the HTTP_SERVER and DIR_WS_ADMIN to the same settings as HTTPS_SERVER and DIR_WS_HTTPS_ADMIN.

This is all explained in the FAQ on the topic: http://www.zen-cart.com/content.php?56-how-do-i-enable-ssl-after-i-have-installed-zen-cart

Hi Dr.Byte,

Thank you for your reply. I have all settings in admin/includes/configure.php changed, and my all of my admin pages are in SSL secure mode, but still not the admin log in page.

My example settings in admin/includes/configure.php are:
HTTP_SERVER https://www.example.com
HTTPS_SERVER https://www.example.com

DIR_WS_ADMIN '/admin/' (I've renamed my admin, this is just for hypothetical use in here)
DIR_WS_HTPPS_ADMIN '/' left as is in this file as entering any folder gives an error message.

I know that I am obviously doing something wrong, but cannot see what. I would appreciate if you could point me in the right direction. Everything on the store side, customer log in, shopping cart, is in SSL secure mode and working properly.

Thank you in advance for your help,

Jeff

Sorry, I also have the ENABLE_SSL_ADMIN set to true.

Hi Dr.Byte,

In working more on this, my setting of DIR_WS_ADMIN '/admin/' also gave me errors, so I changed it back to just '/' to work properly.

I also found my problem in that I am using a bookmark of mine to access my admin and my bookmark was set to URL http://www.example.com and not https://www.example.com. Once I changed this bookmark to the https URL, my admin log in is now protected.

Sorry for the inconvenience,

Thanks.....Jeff

LOL - funny how old bookmarks can confuse things that might otherwise be obvious. Been there, done that! Ha!

Just FYI, you can take comfort in knowing that even when the bookmark is pointing to the http URL, as long as the configure.php stuff is all correct (and it seems like you've got it right now), the form data will still be submitted over SSL. You can verify that by looking at the <form action="https...."> in the page's raw HTML. As long as that action= attribute is set to an https URL, the data you enter on that page will be encrypted when transmitted ... regardless of the URL used to display that page to you.
Not many people "get" that part of it, but you can take comfort in knowing that it's been right ever since you set ENABLE_SSL_ADMIN to true.

Thanks for being understanding about, as always, user error! Glad to know that I am not the only one, ha,ha,ha!

Thanks for letting me know about the fact that is was secure, but so much better with the lock appearing in the URL.

Thanks for your great help with Zen Cart!

Warm regards,
Jeff