Downloads Dying after SSL install - Please Help!

Hi all,

I thought I had everything working perfectly after my recent installation of a dedicated Comodo SSL Cert on my site; did this as I have switched from PayPal over to LinkPoint.

Well, almost everything was working! My site sells physical goods and digital downloads. On the digital downloads end, when the customer buys something, they always get 2 files as I have set up in attribute manager. One is a zip file (a video file zipped) and the other is an HTML file (encrypted using HTML Guardian, needed for security of our license information) that allows the user to install the required DRM License to play the file they have purchased.

Both of these download types worked perfectly before SSL, the zip was simply downloaded by the user, and the registration html would open in a new page window when the user clicks the "Download" button on their order conf page (or in their order history).

Now what I realize is happening, is that after SSL, both the Order Conf page and the customer order history page are displayed as secure pages (understandably). But now as secure pages, the link to the zip file download works properly (a window pops up and allows user to save to their computer), but when you click 'download' for the HTML license file, it goes to a full page blank window with "about:blank" in the address bar. I tried this in both IE6 and IE7 and got the same result. (Firefox too, but IE has to be used to install the DRM licenses, a requirement of our DRM provider).

So please, can anybody help me or give me some suggestions on how to make this problem go away? I would really appreciate any advice. For now I had to remove the SSL from my site because a bunch of customers could not install their licenses, but of course that is not the proper solution. Why is the HTML download not working when the page is SSL?

And what about this possibility - if there was I way I could make the order details (when customer logs in, looks at order history, clicks on an order, and can download purchased files from there) NOT to be one of the pages called up as https://, then I think that would alleviate the problem somewhat. I could put verbiage that the files had to be downloaded from the customer's order history page, although I am sure there would still be some confusion as people would try to download immediately from the order conf page after payment.

Thanks in advance for any help/pointers.

Best Regards,

Patrick

Attached is an image of what the customer sees when they get to the order conf page, as you can see it is a zip and an HTML, both are needed. Both worked fine before SSL; after SSL the HTML doesn't work.

Sorry to reply to my own thread, but I thought of 2 more quick things - first, the license cannot be saved as a ZIP file, I am sure that would be a quick suggestion from forum members. It can't be done that way.

Next, is there somewhere in the code that specifies which pages are called up as secure, when enable SSL is set to 'true' in the config.php files?

And if that can be safely modified, could it be changed so that account history pages like this

"http://mystore.com/catalog/index.php?main_page=account_history_info&order_id=xxxx"

will come up as a regular http:// page rather than secure (when you have SSL enabled for everywhere else)?

Thanks again for any help.

Regards,

Patrick

OK... investigating more...

It appears that regular HTML files are working OK for download when SSL is enabled. The encrypted HTML files (encrypted with HTML guardian) have an attribute where you can not only disable offline use, but you can also lock files to your domain. This is how I had it set up, but I think the problem may lie in that they are locked to my domain using http://www.mysite.com, not https://. Will investigate more.

But it appears that just a regular HTML file works OK for download when SSL is enabled.

Best,

Patrick

Just tested an encrypted HTML file download from Order Conf page with SSL enabled, but this time the file was encrypted to only hide the source check and WITHOUT the 'referrer check' enabled in HTML Guardian. This time the page opened properly and the license could be installed... so it appears to be a problem with the HTML Guardian encryption, that enabling 'referrer check' is making it incompatible with the SSL (unless maybe putting the https:// address in the referrer check settings may fix it, haven't tried yet...)

Appears to be fixed... will post here in the unlikely event any zenner has the same combination of SSL site with HTML downloads that are encrypted.

The problem was in the HTML Guardian encryption, enabling "referrer check" in that program made the HTML downloads not open with the site SSL enabled.

Encrypted HTML files can still be used, but the settings in HTML Guardian can only be for encrypting the source code and disabling offline use. Also, I tested encrypted HTML files with the "lock files to doman" setting to both ON and OFF, and both worked properly (this makes sure the html page can only be viewed if it is online, and hosted on the domain you specify in the HTML Guardian settings).

Hope this helps anyone who may run into the same problem in the future, if anyone has something to add, please chime in.

Best,

Patrick

In these type situations, a lot of problems can be avoided by providing the file(s) in Zip format.

You did some nice troubleshooting Patrick, but even if only 1 page, Zip files are very useful for avoiding all kinds of problems.