Jump to content



Photo
- - - - -

SSL Implementation Help


This topic has been archived. This means that you cannot reply to this topic.
414 replies to this topic

#361   ffl

ffl
  • Members
  • 25 posts

Posted 07 March 2012 - 03:30

Germ,
I am having problems with my site. everything was working to my knowledge and we were able to check out. my provider (Network Solutions) changed or upgraded their PHP and I started getting errors about eregi and have been fixing them with preg_match. at the same time I have been checked for PCI compliance. they say my cert is not correct. all my browsers say that there is a valid ssl cert in place but I the SSL checks in OsCom don't pass, but I get the Blue Bar and Locked Lock. I have installed your checker files can you check this for me.

David
I PMed my site address to you.

#362   germ

germ
  • Members
  • 13,921 posts

Posted 07 March 2012 - 11:03

I can find nothing wrong with your SSL.
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#363   ffl

ffl
  • Members
  • 25 posts

Posted 07 March 2012 - 14:09

if I check the $_SERVER['HTTPS'] environment variable it returns NULL . Does this indicate a not secure connection?

#364   MrPhil

MrPhil
  • Members
  • 5,288 posts

Posted 07 March 2012 - 16:54

Are you using IIS rather than Apache for a server? Different servers use different ways to deal with SSL. Some have getenv('HTTPS') returning 'on' or '1', while others require you to look at the port number (see previous page). You may have to do some snooping around your code to see where $_SERVER['HTTPS'] gets set, and possibly set it manually, or at least investigate (with your host) why it's NULL instead of some expected value. I don't even see $_SERVER['HTTPS'] used in the vanilla code -- is this used in an add-on? See http://us.php.net/ma...bles.server.php . Note that this listing warns that there is no guarantee that any of these $_SERVER elements will be defined!

#365   germ

germ
  • Members
  • 13,921 posts

Posted 07 March 2012 - 17:58

if I check the $_SERVER['HTTPS'] environment variable it returns NULL . Does this indicate a not secure connection?


Your config file is screwed up because the shop is SSL all the time. Read this.

It applies to you as well.
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#366   Santi67

Santi67
  • Members
  • 2 posts

Posted 22 March 2012 - 13:01

I have enabled SSL in oscommerce installation. In our secure pages (eg )https://farma10.com/...nline/login.php IE and Chrome warn about non secure content. I check that all image and link pathes are relative.
In IE I can see that it does not load the stylesheet (the page is displayed with the images but without styles). If I see the source code from IE, I see

[/color]
 <base href="http://farma10.com/farmacia-online/">
[color="#000000"]

when it should be with the 's'. After reading this threat I think the problem is in application_top.php but any change that you propose for
$request_type = (getenv('HTTPS') == 'on') ? 'SSL' : 'NONSSL';

didn't work.
Could you please guide me to solve the problem?
My includes/configure.php:

  define('HTTP_SERVER', 'http://farma10.com');
  define('HTTPS_SERVER', 'https://farma10.com');
  define('ENABLE_SSL', true);
  define('HTTP_COOKIE_DOMAIN', '.farma10.com');
  define('HTTPS_COOKIE_DOMAIN', '.farma10.com');
  define('HTTP_COOKIE_PATH', '/farmacia-online/');
  define('HTTPS_COOKIE_PATH', '/farmacia-online/');
  define('DIR_WS_HTTP_CATALOG', '/farmacia-online/');
  define('DIR_WS_HTTPS_CATALOG', '/farmacia-online/');
  define('DIR_WS_IMAGES', 'images/');
  define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');
  define('DIR_WS_INCLUDES', 'includes/');
  define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
  define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
  define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
  define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
  define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');[/color]
[color="#000000"]


My myenv.php[b]:
Version 1.2[/b][/color]
[color="#000000"]SSL Variables[/color]
[color="#000000"]HTTP HOST: [][/color]
[color="#000000"]Server Port: [80][/color]
[color="#000000"]SSL Status: [Undefined!][/color]
[color="#000000"]Fowarded Server: [farma10.com][/color]
[color="#000000"]Fowarded Host: [farma10.com][/color]
[color="#000000"]Fowarded By: [Undefined!][/color]
[color="#000000"]$_SERVER['HTTPS']: [Undefined!][/color]
[color="#000000"]Warning!!![/color]
[color="#000000"]The standard osC SSL detection code in /includes/application_top.php may NOT detect your SSL status correctly!!![/color]
[color="#000000"]


NONSSL Variables
HTTP HOST: []
Server Port: [80]
SSL Status: [Undefined!]
Fowarded Server: [Undefined!]
Fowarded Host: [Undefined!]
Fowarded By: [Undefined!]
$_SERVER['HTTPS']: [Undefined!]
Load: 1
My cfgchk.php:
[b]File Permissions:[/b] [b]0444[/b]

Found HTTPS_SERVER:

[b]define('HTTPS_SERVER', 'https://farma10.com');[/b]

[b]HTTPS URL passed check![/b]

Found ENABLE_SSL.

[b]define('ENABLE_SSL', true);[/b]

[b]SSL enable passed check![/b]

Found HTTPS_COOKIE_DOMAIN:

[b]define('HTTPS_COOKIE_DOMAIN', '.farma10.com');[/b]

[b]HTTPS_COOKIE_DOMAIN line parsed![/b]



Parsing application_top.php for SSL detection key...

Found SSL detection key:

[b]$request_type = (getenv('HTTPS') == 'on') ? [/b][b]'SSL' : 'NONSSL';[/b]



Done!




Thank you,
Santi

#367   germ

germ
  • Members
  • 13,921 posts

Posted 22 March 2012 - 16:39

Click Me
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#368   Santi67

Santi67
  • Members
  • 2 posts

Posted 23 March 2012 - 13:44

I contacted the server and they informed me that the variable used is HTTP_HTTPS. I placed in application_top:
$request_type = ($_SERVER['HTTP_HTTPS'] == 'on') ? 'SSL' : 'NONSSL';
and works perfectly.
Thank you very much, Jim.
Santi

#369   glenn_watson

glenn_watson
  • Members
  • 6 posts

Posted 11 May 2012 - 15:33

Hi Germ,

#370   glenn_watson

glenn_watson
  • Members
  • 6 posts

Posted 11 May 2012 - 15:53

Hi Germ,
I have been having the same issue as above, where all browsers are giving a mixed content warning when entering the cart. The shop is still under development but it's release has been delayed due to this problem. I have installed all of your test files in the cataloge can you please have a look at what is causing this problem? I will pm you my site if you could please help.
Thanks,
Glenn

#371   germ

germ
  • Members
  • 13,921 posts

Posted 11 May 2012 - 16:39

You must be on one of those servers that have different folders for SSL and NONSSL.

You'll need to copy the contribution files to the SSL folders for them to work.
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#372   glenn_watson

glenn_watson
  • Members
  • 6 posts

Posted 12 May 2012 - 18:19

Hi Yes you are correct. The hosting company set up a secure folder and copied all of my shop from the public folder to the secure folder. I just realized they copied the files before I modded the configure files, could this be the issue? I just uploades your test file to the secure folder could you please have a look?
Thanks for the help, I was really getting fustrated dealing with Bell Hosting (3 techs and 3 different answers).

#373   germ

germ
  • Members
  • 13,921 posts

Posted 12 May 2012 - 19:24

Looks like you've diagosed the problem correctly.

From what I can see if you copy the /shop/includes/configure.php file from the NONSSL folder to the SSL folder you'll probably be good to go
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#374   glenn_watson

glenn_watson
  • Members
  • 6 posts

Posted 12 May 2012 - 19:39

Yes I was just coming back to tell you I copied the admin/includes/configure.php as well and now I am getting the Google green bar!
Thank you so much for pointing me in the correct direction!!!!
Glenn

#375   hunter22375

hunter22375
  • Members
  • 40 posts

Posted 21 July 2012 - 17:21

I wanted to know if you needed to change the http://mywebsite.com to https://mywebsite.com in both the /catalog/includes/configuration.php and the /catalog/admin/includes/configuration.php files for the SSL to work? Thank you.

#376   germ

germ
  • Members
  • 13,921 posts

Posted 21 July 2012 - 18:33

No.

For dedicated SSL you have to purchase and install a dedciated SSL cert.

Before purchasing a cert talk to your host about server requirements.
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#377   andrea.freddi

andrea.freddi
  • Members
  • 11 posts

Posted 25 July 2012 - 13:31

hello germ

i'm trying to implement ssl for my site, but can't get it running and need some help.
i've read this post and also tried to change the "getenv" to "1" and also to "port 443" according to post #2, but with no success at all /whistling.gif' class='bbc_emoticon' alt=':-' />(
everything seems to work fine until i hit the "confirm order" button, which gives me the following error:

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.


customers account is created and i also get the order-email
ssl-help is still on the server (www.schoof-betriebsausstattungen.com/shop)

my conf files are:

- shop/includes/configure.php

define('HTTP_SERVER', 'http://www.schoof-be...sstattungen.com');
define('HTTPS_SERVER', 'https://uranus.safe-...sstattungen.com');
define('ENABLE_SSL', true);
define('HTTP_COOKIE_DOMAIN', 'schoof-betriebsausstattungen.com');
define('HTTPS_COOKIE_DOMAIN', 'uranus.safe-order.ch/~schoof-betriebsausstattungen.com');

- shop/admin/includes/configure.php (admin is renamed)

define('HTTP_SERVER', 'https://uranus.safe-...sstattungen.com');
define('HTTP_CATALOG_SERVER', 'https://uranus.safe-...sstattungen.com');
define('HTTPS_CATALOG_SERVER', 'https://uranus.safe-...sstattungen.com');
define('ENABLE_SSL_CATALOG', 'true');

let me know if you need more information, any help would be greatly appreciated
thx

#378   germ

germ
  • Members
  • 13,921 posts

Posted 25 July 2012 - 20:33

That isn't caused by your SSL config. Looks like an error in a PHP fille to me.

Check your error log.

If you don't have one you can force the site to make one for you. Follow the posts by steve_s starting here

That thread is about the admin but you can do the same thing on the catalog side - I've tried it.
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >

#379   andrea.freddi

andrea.freddi
  • Members
  • 11 posts

Posted 26 July 2012 - 08:00

hi germ

thx for your quick reply /smile.png' class='bbc_emoticon' alt=':)' />
followed the instructions on the mentioned post (i've tried it in shop/include and also in shop/admin/includes), but its not working (even with the path replacement), the text file remains empty /sad.png' class='bbc_emoticon' alt=':(' />
may i pm you my ftp credentials so you'll have a look for me?

andrea

#380   germ

germ
  • Members
  • 13,921 posts

Posted 26 July 2012 - 10:23

Get your host to set up an error log for you.
If I suggest you edit any file(s) make a backup first - I'm not perfect and neither are you.

"Given enough impetus a parallelogramatically shaped projectile can egress a circular orifice."
- Me -

"Headers already sent" - The definitive help

"Cannot redeclare ..." - How to find/fix it

SSL Implementation Help

Like this post? "Like" it again over there >