xampp and Admin with SSL

I am running ZC 155d on my W10 PC using xampp for my test site.

When I set configure.php in Catalog/includes as SSL then everything works fine.
When I run www.your_site.com/extras/curltester.php then I get a couple of pages of "goods".
I have Paypal as one of my payment methods and that works OK

When I set configure.php in Catalog/admin/includes as SSL then I get the following error messages.

Chrome
This site can’t provide a secure connection
localhost sent an invalid response.

MSEdge
Cannot securely connect to this page
This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner.

Any suggestions welcome, I am posting this because I just installed Braintree plug in and it give an SSL error message so might be connected?

I am using ApacheFriends XAMPP Version 5.6.24 ######

• Apache 2.4.23
• MariaDB 10.1.16
• PHP 5.6.24 (VC11 X86 32bit thread safe) + PEAR
• phpMyAdmin 4.5.1
• OpenSSL 1.0.2d
• ADOdb 518a
• Mercury Mail Transport System v4.63 (not included in the portable version)
• FileZilla FTP Server 0.9.41 (not included in the portable version)
• Webalizer 2.23-04 (not included in the portable version)
• Strawberry Perl 5.16.1.1 Portable
• Tomcat 7.0.56
• XAMPP Control Panel Version 3.2.2 by hackattack142 (Great Thanks!!))
  See: http://www.apachefriends.org/f/viewtopic.php?f=16&t=46743
• XAMPP mailToDisk 1.0 (write emails via PHP on local disk in <xampp>\mailoutput. Activated in the php.ini as mail default.)

you can try the solution listed here:

http://www.chasewoodford.com/blog/fixing-localhost-ssl-connection-error-in-google-chrome/

When you say that in catalog/admin/includes/configure.php that the system is set to use SSL, please identify what that means is set to you?

Ie. What are the various server constants and the SSL_ related constants?

marton_1:

I am running ZC 155d on my W10 PC using xampp for my test site.

I am using ApacheFriends XAMPP Version 5.6.24

Out of the box, xampp is not secured unless you follow the How to Secure instructions. Also it does not come with a certificate installed so any requests for SSL is not going to work. There are instructions on ApacheFriends forum and also if you Google for it, on creating, signing and installing self signed certificates. Even then browsers well complain that its self signed and not from an outside singer.

If you did all this already, then as per MC comments, its something in the config files..

mc12345678:

When you say that in catalog/admin/includes/configure.php that the system is set to use SSL, please identify what that means is set to you?

Ie. What are the various server constants and the SSL_ related constants?

I meant
define('HTTP_SERVER', 'https://localhost:8080');
define('HTTPS_CATALOG_SERVER', 'https://localhost:8080');
define('DIR_WS_HTTPS_CATALOG', '/zencart155d/catalog/');

Cheers

carlwhat:

you can try the solution listed here:

http://www.chasewoodford.com/blog/fixing-localhost-ssl-connection-error-in-google-chrome/

Tried that, good ides but did not fix it. I have the same problem with MSEdge

search "install ssl certificate for localhost xampp" in google

As I wrote in my original post, PayPal (which requires SSL) payment method works fine in my xampp test site so clearly the SSL certificate was correctly installed.

Are you using a dynamic dns service to allow Paypal to access your local server to complete the order?
I ask, as your configure settings indicate not, but you say Paypal works i.e. it completes the order.

torvista:

Are you using a dynamic dns service to allow Paypal to access your local server to complete the order?
I ask, as your configure settings indicate not, but you say Paypal works i.e. it completes the order.

No,
as I wrote in my original post when I test SSL by running www.your_site.com/extras/curltester.php then I get a couple of pages of "goods" and no negatives.

marton_1:

No,
as I wrote in my original post when I test SSL by running www.your_site.com/extras/curltester.php then I get a couple of pages of "goods" and no negatives.

This is testing whether your site can access external sites using SSL. It says nothing about whether external sites can access your site using SSL.

Cheers
RodG

Some things, like payment modules, are always better tested on a real webserver, not a mock server such as Xampp.
For SSL on xampp, you'll need to set up your own SSL. And if you do it with a self-signed certificate, then most of your payment modules will still fail because they expect authentic SSL, not self-signed SSL.

For payment modules, just go direct to a real server. Don't try to use them on a local PC.

marton_1:

This site can’t provide a secure connection
localhost sent an invalid response.

Have you created and installed a certificate for 'localhost' - or are you trying to use the certificate for 'www.your_site.com' ?

Cheers
RodG

While you can indeed have your local server working with the outside world as though it is on a real server, there are several hoops you have to jump through to get there. Since the times you really need such a setup are so rare, it really is not worth the time and effort (and risk) to get it working compared to the ease of setting up a real development server (a duplicate of your real shop on your hosting).
I jumped though all those hoops through sheer bloody mindedness but rarely use it. I do however have my local servers set up as virtual hosts. I found that was necessary for uri-rewriting to work locally.

Thanks everyone for your help.
As suggested I will switch to doing my testing on a real server :)

marton_1:

Thanks everyone for your help.
As suggested I will switch to doing my testing on a real server :)

This is most certainly the best way to save a little sanity - Unless you wish to become a network engineer as well as a web developer :)

torvista:

While you can indeed have your local server working with the outside world as though it is on a real server, there are several hoops you have to jump through to get there. Since the times you really need such a setup are so rare, it really is not worth the time and effort (and risk) to get it working compared to the ease of setting up a real development server (a duplicate of your real shop on your hosting).

Agreed. 100%

marton_1:

I jumped though all those hoops through sheer bloody mindedness but rarely use it. I do however have my local servers set up as virtual hosts. I found that was necessary for uri-rewriting to work locally.

I however, went through those hoops many years ago and to this very day not only use it for local development but we also serve some of our webpages (and all of our live camera feeds) directly from computers on our home network to the public internet. This wasn't/isn't out of bloody mindedness though, it is a matter of economics.
Back in the day we even used to host customers websites on our own computers - A practice we stopped doing when it became cheaper (and far less work) to use shared/3rd party hosting than it was to maintain our own hardware.

It is still more practical (and economical) to use our own computers for some/many things though, and although you mention risk as being a factor, which I don't disagree with, I can say with 100% confidence that our LAN based servers are far more secure than any 3rd party server could ever be, which is one of the reasons we still use them.

Having said that, I do agree with you 100% that there are hoops to jump through and the need for such as setup is rare and not worth the time or effort, at least for most folk - but it also saddens me that by avoiding this also increases ignorance in regards to how the internet actually functions - I don't say this to cause any offence to anyone - but from a security perspective I do find it a bit of a worry.

Cheers
RodG

marton_1:

Thanks everyone for your help.
As suggested I will switch to doing my testing on a real server :)

marton,
if you are changing your development environment, i am a big fan of using virtualBox on your local machine and then using vagrant for a pre-built LAMP stack. i use this box as it is relatively easy:

https://box.scotch.io/

you can then put all of your code under version control, ie git, set up remote repository in a place like bitbucket. and then deploying any code changes becomes rather easy.

its a bunch of work to get your development environment set up just right, but once you get your work flow together, its way easier with real good audit trails.

good luck in whatever you decide to do.