SSL problem

I've just set up SSL for my site by doing the following:

1. Created subdomain secure.sparklefish.co.uk

2. Bought a SSL cert for secure.sparklefish.co.uk and installed on server via cPanel

3. Changed configure.php to read
   // Define the webserver and path parameters
   // HTTP_SERVER is your Main webserver: eg, http://www.yourdomain.com
   // HTTPS_SERVER is your Secure webserver: eg, https://www.yourdomain.com
   define('HTTP_SERVER', 'http://www.sparklefish.co.uk');
   define('HTTPS_SERVER', 'https://secure.sparklefish.co.uk');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

However, when I try to access customer login I get the following message (Firefox):
"The connection to https://www.sparklefish.co.uk was interrupted while the page was loading."

I know I've done something wrong but not sure what. Anything obvious or should I contact my web host? Do I need to move any files into another directory?

Thanks

Sorry, my mistake, the error message reads

The connection to secure.sparklefish.co.uk was interrupted while the page was loading.

You didn't restart Apache after installing the full ssl cert, so it's still listed as being the self-signed cert for 'sparklefish.co.uk'

Vger

Thanks - my web host has reinstalled the cert and but now get a page not found error.

Sorry for the basic question, but do i need to move code to another folder (ie the secure folder?) I've set up the subdomain secure.sparklefish.co.uk and have a SSL for secure.sparklefish.co.uk?

Yes. If your host has provided you an http AND https directory space, then you will need to maintain a copy of your Zen Cart in both directories. Your admin/includes/configure.php AND includes/configure.php files also need to reflect the correct paths.

See the following for additional guidance. FAQ :: How do I configure for SSL/HTTPS (secure socket layer) after I have installed Zen Cart?

Thanks - my inexperience in these things is showing.

I'm going to try and get my SSL cert changed to my whole site rather than the secure sub-domain. If no joy, then I'll maintain 2 versions of the cart in both locations (not preferred).

I'll also sort out the admin SSL as you say.

Cheers

Technically SSL 'best practices' is to have 2 separate file locations. One for non-secure and one for secure. It is quite common to have the 2 directories and maintain as such. :smile:

(Typically you would only place the necessary files in the https directory. However, it is just plain easier to maintain a complete second copy of your Zen Cart in both.)

The only reason you need to have two sets of files is because your hosts didn't set up the server correctly. If the server uses a Plesk control panel then all they needed to do was to tick a box during the server setup to use just one fodler for http and https files. On any other control panel they can 'symlink' (symbolically link) the httpsdocs folder to the httpdocs folder and then you only need to maintain one set of files.

I have to admit that I don't know why it would be "SSL best practice" to have two separate sets of files/folders, and after six years in hosting have never heard of such a rule.

Vger

Vger:

I have to admit that I don't know why it would be "SSL best practice" to have two separate sets of files/folders, and after six years in hosting have never heard of such a rule.

So as not to hijack this thread down a different path of discussion, I'll briefly reply. I agree with your statement and have asked many over the years. Opinions are fairly balanced. In theory, why encrypt pages, files, etc...if your going to have the same ones available via http AND https? It's not a "rule", but a good practice. Keeping in mind that there are many different types of web applications, it is a general statement. Perhaps a diminishable one as web servers and their applications become more secure in their design and execution. :smile:

Based on what this thread is saying is it therefore possible to:

• redirect my subdomain (secure.sparklefish.co.uk) to https://www.sparklefish.co.uk
• ask my webhost to symbolically link the httpsdocs folder to the httpdocs folder

and thus only have 1 set of files to maintain. Would this work in my case?

For anyone who's interested - I contacted my host but cannot symbolically link as I am on Linux and only have one public_html folder. Thus i can either get a cert (which I should have done in the first place) to cover the whole site or I can maintain 2 sets of code.

Thanks to those who've contributed to this thread.

Many certificate providers offer a free reissuance of the certificate - but whether they'd agree to this being for a different domain is open to question, but there's no harm in asking.

Vger

lib99:

Technically SSL 'best practices' is to have 2 separate file locations. One for non-secure and one for secure. It is quite common to have the 2 directories and maintain as such. :smile:

(Typically you would only place the necessary files in the https directory. However, it is just plain easier to maintain a complete second copy of your Zen Cart in both.)

In a situation where you have only static HTML pages to serve content, this may be logical.
In a dynamically generated site using databases to store information, such as is offered via Zen Cart and other PHP-scripted systems, that entire theory goes out the window, and in fact separate folders for SSL-accessed content becomes a chore and pointless.
The only case where this would be valuable would be if downloads of certain content stored in static files had to be served via SSL due to the nature of its content. In that case, it makes sense. There are ways around that using scripting and redirects in order to ensure such content is dynamically served only as secure.

sparklefish, you have created a setup that requires you to have two SSL Certs or "all" files in one directory.

1. Created subdomain secure.sparklefish.co.uk
2. Bought a SSL cert for secure.sparklefish.co.uk and installed on server via cPanel

All files would have to reside in the directory for 'secure.sparklefish.co.uk'.

This is shown as the problem stated in your first post,
"However, when I try to access customer login I get the following message (Firefox):
The connection to https://www.sparklefish.co.uk was interrupted while the page was loading."

• https://www.sparklefish.co.uk does not have an SSL Cert but the login requires an SSL connection

With your current setup you would have to turn OFF using SSL for your main site.

configure.php would read
define('HTTP_SERVER', 'http://www.sparklefish.co.uk');
define('HTTPS_SERVER', '');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'false');

Having all of the site served up from ssl would be a major mistake, as Search Engines don't rank https pages.

Vger

Hi all,
I have a subdomain setup for my ZenCart store. It is supposed to be linked to a subdirectory in my main site's public_html directory. In my manage subdomains area of cpanel, it appears that that is setup. However, when I attempt to access my admin area I get this message:
The page cannot be found
The page you are looking for might have been removed, had its name changed, or is
temporarily unavailable.
Please try the following:
If you typed the page address in the Address bar, make sure that it is spelled correctly.
Open the
store.equineshop.biz
home page, and then look for links to the information you want.
Click the
Back
button to try another link.
Click
search.gif (114 bytes) Search
to look for information on the Internet.
HTTP 404 - File not found
Internet Explorer

I can reach my stores home page, but cann't reach any other pages from it. I get the same message as above.
I'm guessing it has something to do with the SSL, which is setup and installed for store.equineshop.biz and how the subdomain and subdirectory are setup.
Any help greatly appreciated.
Melissa
store.equineshop.biz

Open both config files and look at the following -- I'm guessing this what you have.
define('HTTP_SERVER', 'http://equineshop.biz/store');
define('HTTPS_SERVER', 'https://equineshop.biz/store');

And this is what it should be:
define('HTTP_SERVER', 'http://store.equineshop.biz');
define('HTTPS_SERVER', 'https://store.equineshop.biz');

Warning: I am able to write to the configuration file:
This is a potential security risk - please set the right user permissions on this file (read-only, CHMOD 644 or 444 are typical).

You should correct that problem immediately.

Note: make sure that all ZenCart files have been uploaded into your directory: public_html/store/

Website Rob:

Open both config files and look at the following -- I'm guessing this what you have.
define('HTTP_SERVER', 'http://equineshop.biz/store');
define('HTTPS_SERVER', 'https://equineshop.biz/store');

And this is what it should be:
define('HTTP_SERVER', 'http://store.equineshop.biz');
define('HTTPS_SERVER', 'https://store.equineshop.biz');
This is what I have.

You should correct that problem immediately.
Allready done.

Note: make sure that all ZenCart files have been uploaded into your directory: public_html/store/
This is where they are all located.

Perhaps the subdomain is not properly linked to the subdirectory?

you want (assumed)
http://store.equineshop.biz
https://store.equineshop.biz

but in your configure.php files you've defined it as
http://www.equineshop.biz/store/ <-- www.
https://store.equineshop.biz/store/ <-- store.

Your sub-domain configuration is already pointing to the public_html/store server location. So you don't need to define that for the http and https. You will need to define those physical server paths (file locations) elsewhere in your configure.php files.

use
http://store.equineshop.biz
https://store.equineshop.biz (without /store at the end)

This is what I have in my admin/includes/configure.php file.
define('HTTP_SERVER', 'http://store.equineshop.biz');
define('HTTPS_SERVER', 'https://store.equineshop.biz');
define('HTTP_CATALOG_SERVER', 'http://store.equineshop.biz');
define('HTTPS_CATALOG_SERVER', 'https://store.equineshop.biz');

define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

This is what I have in my includes/configure.php file.
define('HTTP_SERVER', 'http://store.equineshop.biz');
define('HTTPS_SERVER', 'https://store.equineshop.biz');

define('ENABLE_SSL', 'true');

Is there something I need to change?
Melissa
https://store.equineshop.biz
PS. I just changed it to this setup.