Connection Partially Encrypted - SSL Problem - Google Checkout installed

I have my own SSL certificate and have updated the configuration.php files with the secure server information and have set the enable SSL variables to true in both files. The admin section of the website works just fine however the catalog section of the website only shows partial encryption on the https pages. I have a very vanilla install of zen-cart 1.3.7 and it appears as though the only thing on the https pages that is encrypted is the form data from the login part on that page and the credit card data on the checkout page. Everything else images, links, and etc. are not encrypted. Do I have some setting massively wrong?

Website can be found at:
another_game_store(dot)com

(leave out the underscores in the url and change the (dot) to a period)

Any help would be appreciated.

Thanks,
Caveman

This is normal Cart action and should be what you want as SSL slows down your shoppers if it were to be for the full site as only the sensitive information requires the SSL

I can agree with what your saying Kobra. But I should define the problem in more detail. The worry that I have is that in IE when someone goes to the login or checkout pages they get a warning box alerting them that the page contains unencrypted items and the address bar doesn't turn yellow and the gold padlock doesn't appear. In firefox the address bar doesn't turn yellow and the padlock has a diagonal line through it. Thus for most online shoppers it would probably appear as though the page isn't secure.

Is there anyway to get the secure pages to appear as secure as they are?

Is this a private SSL issued to your site? Or a shared SL cert?

The page contains unencrypted items, usually indicates that you have hardcoded some image links instead of using a relative link.

A url to your site would be helpful

Looking at your site shows that ALL of the images controlled by the cart are left unsecure,

have you made any changes to the includes/templates/template_default/html_header.php

if Not try uploading a fresh copy

and for curiositys sake who are you hosting with?

Kobra, it is a private SSL certificate. And to the best of my knowledge there aren't any hard coded images. Very few modifications to the default template have been made.

Merlin, the html_header.php file that I found was in /included/templates/default_template/common/html_header.php

If that is the wrong html_header.php file let me know. I uploaded a fresh copy of it to the web server as I am fairly certain that it had not been modified. The problem still seems to exists.

As for the hosting company it is Network Solutions. Not the greatest but decent for the price.

thanx for correcting my error,
yes it is in common,
I shouldnt try to answer questions when I first get up

I would try asking your host, since we know that the code works,
they way want to make sure that the ssl is installed correctly,

We're seeing the exact same problem and we're hosting ourselves. There's nothing wrong with the SSL Certificate; it's been working on the previous store for years, and we've installed dozens of them, so it's not a question of it not being installed correctly. Also all the links in the store admin are set to non-SSL, looking at the code.

I contacted the hosting company and they said that the certificate was installed properly and that I should contact the company that issued the certificate so I did that. The company that issued the certificate said that the certificate was working properly and was installed properly on the hosting side. They (the certificate company) said the problem was the links to the images were using http in the source and not https.

So I guess the question now is how do I get the catalog to use https in the src links instead of http on secure pages?

Caveman,
I am experiencing exactly the same issue. I have arrived at the same point as your last post on August 3rd.
My post isn't too helpful, but I am anxious to see it resolved!

Suggest you do a search on the forum for Network Solutions - They have some very odd settings somewhere that prevent Zen Cart from properly detecting the HTTPS. You need a new host.

I believe that Kim has the most logical answer to this problem. I've battled back and forth with the tech's at Net Sol all day today and they have blamed everyone and everything except themselves. They don't seem interested in even checking if the problem could be on their end. I'm going go one more round with them then cut my loses an move on to another hosting company if they won't take the problem seriously.

I'm more than willing to try any suggestions to solve this problem that anyone has to offer but it may very well be that ZenCart conflicts with the sales of Net Sol's eCommerce system and will never be resolved on their servers.

Thanks for the help thus far.

Well, Net Sol finally got back to me with the final version of the help that they are offering. Here is their suggestion from the e-mail they sent me.
:lamo:

Your images and stylesheets are linked using http: instead of https: due to the way Zen cart is creating the links in PHP.
By changing line 17 of your /htdocs/store/includes/configure.php file from:
define('HTTP_SERVER', 'http://www.anothergamestore.com');
to
define('HTTP_SERVER', 'https://www.anothergamestore.com');
all of your links become https: links. The page is then fully encrypted and is recognized as such by browsers. As Zen cart is a third party produce, we cannot provide support for it. You will need to contact the manufacturer for further information on how to set your cart to properly create encrypted pages.I did as they suggest and yes the encrypted pages are now fully encrypted. So is the rest of the site too, even the pages that aren't supposed to be encrypted. I guess that's the best that Net Sol can do.

Caveman:

I did as they suggest and yes the encrypted pages are now fully encrypted. So is the rest of the site too, even the pages that aren't supposed to be encrypted. I guess that's the best that Net Sol can do.

Yes, that's the best that they (Network Solutions) can do.

Running the general catalog in https requires that each request be encrypted-decrypted adding to page load/rendering time for all pages and not the ideal situation for a graphic intense presentation.

DrByte:

Yes, that's the best that Network Solutions can do.
Hi Folks,
I do not think this is specific to Network Solutions alone. I am hosting stores on GearWorx and In Motion Hosting and am seeing the same situation.

While I agree that encrypting the entire site is not the most effecient way to do this, it seems to be the only way it will get around this problem for now.

Will the Zencart team look into this to see if there is another way through some additional configuration on teh next release?

While I agree that encrypting the entire site is not the most effecient way to do this, it seems to be the only way it will get around this problem for now.

Will the Zencart team look into this to see if there is another way through some additional configuration on teh next release?
I can assure you that this is server configuration related and NOT the Zen Cart code.

PM me for a list of sites that work as designed on servers that are configured correctly.

I also see the same thing. If I read the posts right. For example, once logged in, on the main page (home), if I click on a manufacturer in that sidebox, I get a security warning from Firefox that the information I am sending is going over an unencrypted connection. If I type something in the search box and hit return, same thing.

I reviewed the code in tpl_search.php sidebox, and, sure enough, the draw form EXPLICITLY says NONSSL, meaning, guaranteed to get this behavior.

Perhaps this is slightly different than others are saying, but, this is not good! We do not want people to get those types of warnings, it scares people as 99% of them have no clue what it really means.

The same applies to other boxes, say manufacturers.

This IS a coding issue. At least for these examples.

So, I guess my question is why the code forces NONSSL and thus causes the warnings?

For example, once logged in, on the main page (home), if I click on a manufacturer in that sidebox, I get a security warning
Once logged in you should be back to http and therefore no warnings will be invoked.

DonRichardsonNH:

Hi Folks,
I do not think this is specific to Network Solutions alone. I am hosting stores on GearWorx and In Motion Hosting and am seeing the same situation.

While I agree that encrypting the entire site is not the most effecient way to do this, it seems to be the only way it will get around this problem for now.

Will the Zencart team look into this to see if there is another way through some additional configuration on teh next release?

Can you share a URL where this is happening?
What version of Zen Cart?
What addons/contributions are installed?