SSL suggestion

I have added also what follows to avoid continuous requests to change admin passwords at login.
RewriteCond %{REQUEST_URI} !^/youradmin(/|$)
so, all in all the .htaccess, in order to have everything working correctly, got the following lines:

#Redirect all to https but anyotherfoldertoexclude and youradmin
RewriteCond %{REQUEST_URI} !^/anyotherfoldertoexclude(/|$)
RewriteCond %{REQUEST_URI} !^/youradmin(/|$)
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

Ciao from Italy
enzo

enzo-ita:

I have added also what follows to avoid continuous requests to change admin passwords at login.
If using SSL is causing you to get password-change required repeatedly then your site is NOT properly using "only SSL" for the Admin ... which suggests that you've got incorrect rewrites that are switching it incorrectly into non-SSL before going to the actual URL.

And with v1.5.5 the admin operates entirely in SSL if you give it an SSL URL ... doesn't flip back and forth with any NON-SSL at all. (same as setting HTTP_SERVER to an https URL and setting ENABLE_SSL_ADMIN to 'false')

TKS.
By now I will live with the .htaccess mods I made.
Soon I will switch to 1.5.5 (as soon as I will be happy with the FEC plugin mods that I am doing) and I think alla theproblems will disappear because I am plannig to go to 1.5.5 treating it as new install.
Ciao ciao
enzo

DONE!
I am very happy to tell you all that finally 1.5.5a is on line!
For a small business like mine and considering I do no use any web agency neither programmer or graphic (I do all on my own, with the precious help of this forum) it is a real success.
I still have a problem though and it is related to ssl

I have set HTTP server as https and to false in both store and admin.
I did not like the fact that if I call http://www.acquat ua.it it does not go directly to https://www.acquat ua.it so I mde a mod to the htaccess like follows
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]
This actually did the job and also non https request is redirected to https Yeah! but...
If I let the htacces as above, livelizza would not allow to login, if I disable the two lines livezilla will login perfectly.
Now for the questions:

As far as the big G and others are involved, is it important that http is redirected to https since the first page?
If what above is true, how can I make livezilla login even with http redirected to https?

Note that in the livezilla serve admin I have set the server to be https and the port 443.

It is not a mjor problem but I have started this migration with the ami to create the best possible setting and this is bothering me.

Thanks for help.

ciao from Itlay
enzo

No problem I solved also the livezilla incident.
I had two servers configuration set and it was trying to login to the http while htacce was redirecting to https therefore trowing an error.
Deleted the http and set the https as default now it works.
However, thanks again to everyone for the precious help.
I'll be waiting 1.6.0....:cool::laugh::lookaroun

All-in-all congratulations on getting setup and going. Good work!

Hopefully you will continue to visit and support others on their journey!

Thanks for the congrats.
I do not feel that I am capable to support anyone since I need support myself!
However I will certainly be visiting the forum regularly.
Ciao ciao
enzo

enzo-ita:

Thanks for the congrats.
I do not feel that I am capable to support anyone since I need support myself!
However I will certainly be visiting the forum regularly.
Ciao ciao
enzo

We all do at one time or another need support. Wouldn't be much of a community if that didn't exist. I'm sure there is something you have learned along this journey that could help the next individual with similar ttroubles. A link to a post or FAQ, how you resolved the same thing, maybe even a gentle nudge to provide more related information. In the long run such assistance is likely to help you get to know ZC even more. :)

Hope you have a good weekend and keep reading!

Hi guys.
I am bringing u this thread because I am desperate.
Since when I switched to SSL for the whoel site my sales dropped to about 30% of last year after seve year of constant sales increase year over year but even month to month.
I know this may sound dumb and it should be impossible but I have really watched out all I know, checked and checked twice, statistics, adwords, analytcs and alla the other tools available. The only real connection to this drop seems to be the switch from non ssl to ssl (ssl for check out was there also before)
I wonder if I may have done something wrong.
Please let me know your opinion about.
Thanks

- ENABLE_SSL should be set to 'false' (because ENABLE_SSL is only set to 'true' when you want ZC to switch back and forth between http and https for certain secured pages)

I don't find this nugget documented ANYWHERE else...in fact after spotting it last week it took me ages to find this post again to recheck it (doing this on my site caused a bug to surface https://www.zen-cart.com/showthread.php?184548-Ceon-URI-Mapping-v4-x&p=1319093#post1319093).
The faq/tutorial needs to be updated with this info.

BUMP

*ENABLE_SSL should be set to 'false' ...
*The faq/tutorial needs to be updated with this info.
Although I knew this nugget of information existed it still took me too long to find it again.

It should be referenced in the other common places Google throws up for SSL searches:

https://www.zen-cart.com/showthread.php?221740-How-can-I-change-all-links-in-the-store-to-be-https-if-the-site-accessed-via-https&p=1325325#post1325325
https://www.zen-cart.com/entry.php?8-SSL-Explained-Back-and-Front
https://www.zen-cart.com/content.php?56-how-do-i-enable-ssl-after-i-have-installed-zen-cart

As a result of discussions in a handful of other threads not quoted here, I've updated my earlier post with an additional note:

***NOTE: Some people have reported that setting ENABLE_SSL to 'false' in this case may cause confusion to some payment module configurations which expect SSL and rely on the ENABLE_SSL setting to confirm it. Thus, in some cases it may still be wise to leave ENABLE_SSL set to 'true' even when using https on all pages.
**