I have a SSL certificate which is mapped to "hobbyhillfarm.com" NOT "www.hobbyhillfarm.com"
I have since upgraded my zen-cart to v1.3.8

the full url to store is:
http://www.hobbyhillfarm.com/store/

I am only getting https for login, not all /admin/ pages.
What am I missing ??

I read something on in this forum about a symlink to/from /ssl.
Is this something I need to confirm ?? and how-to ??

From: https://www.zen-cart.com/tutorials/index.php?article=14
How do I enable SSL after I have installed Zen Cart?

NOTE: As of v1.3.x, the Admin area can only secure the "login" page via SSL unless you set the HTTP_SERVER in your "admin/includes/configure.php" to an SSL URL, in which case the entire admin area will be treated as SSL rather than only selected relevant pages....

includes/configure.php

  define('HTTP_SERVER', 'http://www.hobbyhillfarm.com');
  define('HTTPS_SERVER', 'https://hobbyhillfarm.com');

  // Use secure webserver for checkout procedure?
  define('ENABLE_SSL', 'true');

  define('DIR_WS_CATALOG', '/store/');
  define('DIR_WS_HTTPS_CATALOG', '/store/');

admin/includes/configure.php

  define('HTTP_SERVER', 'http://www.hobbyhillfarm.com');
  define('HTTPS_SERVER', 'https://hobbyhillfarm.com');
  define('HTTP_CATALOG_SERVER', 'http://www.hobbyhillfarm.com');
  define('HTTPS_CATALOG_SERVER', 'https://hobbyhillfarm.com');

  // Use secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'true');
  define('ENABLE_SSL_ADMIN', 'true');
  
  define('DIR_WS_ADMIN', '/store/admin/');
  define('DIR_WS_CATALOG', '/store/');
  define('DIR_WS_HTTPS_ADMIN', '/store/admin/');
  define('DIR_WS_HTTPS_CATALOG', '/store/');  

Get all to match the certificate ...

If the Certificate is for:
www.your_domain_name.com

Then use the www. on all of the server URLs ...

If the Certificate is NOT for the www then do NOT use the www for any of the server URLs in the configure.php files ...

Thank you for the quick response.

I made your suggested changes,
define( .... , 'http://hobbyhillfarm.com');
define( .... , 'https://hobbyhillfarm.com');

But this does not fix my issue.

The certificate is for hobbyhillfarm.com
This is not a share certificate.
I do have a dedicated IP.

Got any other ideas??

Regards,
Don

I noticed the same problem...only the admin login page is secure. I've got the
HTTPS_CATALOG_SERVER constant set to the correct secure address, and ENABLE_SSL_ADMIN is set to true.

After looking through the code in the /admin folder, it seems (unless I'm really missing something—and if so, somebody please correct me) that every link within the admin is set to use a NONSSL protocol. Examples:

zen_href_link(FILENAME_CONFIGURATION, 'gID=' . $configuration_groups->fields['cgID'], 'NONSSL')

zen_href_link(FILENAME_CUSTOMERS, '', 'NONSSL')

For the life of me, I can't imagine why. What's the point of even having the ENABLE_SSL_ADMIN constant if it doesn't do anything?

To try to force everything into secure mode, I tried adding this to the .htaccess file in the admin folder:

If not in secure mode, redirect to it

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

But this breaks various features—some forms don't work when you try to submit them.

Seems like the admin wasn't actually even designed to run in secure mode. I notice that FCKEditor doesn't even load, and I get a security warning (some unencrypted items) on the page.

Maybe somebody else has some insight here...

well the issue with ONLY the admin login page being secure is thats All thats designed to be seucre at this time,

If you want to have the entire admin secure then you need to set all 4 defines in the adin cionfig tio use the https url

IF your site is hosted on an Apache server, and
IF your site has a Full SSL Certificate
then you can try this.

In your admin folder .htaccess file add this code:

SSLRequireSSL
ErrorDocument 403 https://www.yourdomain.com/admin/

This will redirect all http requests to https pages, thus securing all of your admin under SSL.

DON'T try it with Shared SSL, it won't work.

It may not work anyway - depends on your server setup.

Vger

Vger—great way to keep people out if they try to access the admin under http...but wouldn't exactly allow you to work in the admin yourself in secure mode, since every link you click in the admin would then take you to your "error" page.

Anyway, Merlinpa1969's solution seems more practical and completely workable. It's so darn simple I feel dumb I didn't think of it.

No, it doesn't take you to an error page, whilst technically being an error it is a redirect to https. We use this on all our customer sites with a full ssl certificate as it encrypts all data in and out of the admin panel.

Yes, you will get some additional entries in the error log but that log is active only for a few days and then gzipped and archived to a very small file size - so no problems there either.

Vger

Vger:

No, it doesn't take you to an error page, whilst technically being an error it is a redirect to https.
Vger

problem is that it doesn't allow you to logoff. it puts you in a mouse trap where you just keep getting back to the admin page

Merlinpa1969:

If you want to have the entire admin secure then you need to set all 4 defines in the adin cionfig tio use the https url

so for the noobs out there, i.e. me, how's this done?
thx

dear all,

DrByte advised an easy chage for this SSL admin. see below.

If you want all your admin pages to be SSL, copy your setting for HTTPS_SERVER to HTTP_SERVER in your /admin/includes/configure.php:smile: file.

**Back to the original post of the thread and the response that this DOES NOT work for urls missing the www.

What is the proper solution and is www. designated anywhere else in the code and need to be taken out?**

I have a SSL certificate which is mapped to "hobbyhillfarm.com" NOT "www.hobbyhillfarm.com"
I have since upgraded my zen-cart to v1.3.8

the full url to store is:
http://www.hobbyhillfarm.com/store/

I am only getting https for login, not all /admin/ pages.
What am I missing ??

I read something on in this forum about a symlink to/from /ssl.
Is this something I need to confirm ?? and how-to ??

Quote:
From: https://www.zen-cart.com/tutorials/index.php?article=14
How do I enable SSL after I have installed Zen Cart?

NOTE: As of v1.3.x, the Admin area can only secure the "login" page via SSL unless you set the HTTP_SERVER in your "admin/includes/configure.php" to an SSL URL, in which case the entire admin area will be treated as SSL rather than only selected relevant pages....

includes/configure.php

Code:
define('HTTP_SERVER', 'http://www.hobbyhillfarm.com');
define('HTTPS_SERVER', 'https://hobbyhillfarm.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

define('DIR_WS_CATALOG', '/store/');
define('DIR_WS_HTTPS_CATALOG', '/store/');admin/includes/configure.php

Code:
define('HTTP_SERVER', 'http://www.hobbyhillfarm.com');
define('HTTPS_SERVER', 'https://hobbyhillfarm.com');
define('HTTP_CATALOG_SERVER', 'http://www.hobbyhillfarm.com');
define('HTTPS_CATALOG_SERVER', 'https://hobbyhillfarm.com');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

define('DIR_WS_ADMIN', '/store/admin/');
define('DIR_WS_CATALOG', '/store/');
define('DIR_WS_HTTPS_ADMIN', '/store/admin/');
define('DIR_WS_HTTPS_CATALOG', '/store/');