How to install SSL on OSC: A Simple 1-2-3 Instruction

[jpweber 8]

define('HTTP_SERVER', 'https://dynamicchemical.com'); // eg, http://localhost or - https://localhost should not be NULL for productive servers

define('HTTP_CATALOG_SERVER', 'https://dynamicchemical.com');

define('HTTPS_CATALOG_SERVER', 'https://dynamicchemical.c2.ixwebhosting.com');

 

 

What is that??

 

I'm not worried about whether or not OSC says you're secured in your initial admin page. You want https:// only links once you click on anything within your initial admin page.

[flopez82 0]

so its no big deal for my main admin page not to be secure

 

because at the bottom left of my admin main page its says not secured

 

and if i click on anything on that admin page my address bar turns red and says certificate error

 

for all the pages like "my store , loging cache"

 

things like that

[flopez82 0]

certificate error says

 

the security certificate presented by this website was issued for a different websites address

 

this problem may indicate an attemp to fool you or intercept any data you send to the server

[BillinDetroit 0]

certificate error says

 

the security certificate presented by this website was issued for a different websites address

 

this problem may indicate an attemp to fool you or intercept any data you send to the server

 

Felix. Are you relying on a shared certificate? Even if everything is on the up and up, you will get this (accurate) error message if you are relying on a shared certificate. Think about what it says ... the shared certificate WAS issued for a different website address ... your ISP's!

 

This message means that the system is working as it should. Whenever the certificate and the website trying to use it are not the same, the browser users SHOULD be notified so that they can exercise their own judgment as to whether to continue ... or not. That 'or not' part is the one that concerns us at the moment.

 

What happens is that YOUR website IS presenting a certificate issued to someone else. It has that right (if your ISP is in agreement) but the certificate, shared by perhaps thousands of other websites, was NOT issued in the name of your website.

 

The message is okay. The probability of a security breach is on the order of 'slim to none'. But this is your 'heads up' to get your own private certificate as soon as you have a $20 bill in your control. If this message bothers -you-, just think of the effect it would have on a potential customer.

 

Bill

[sjwdavies 0]

:'( :'( :'( JPWeber I Need Your Help!!! :'( :'( :'(

 

 

I'm new to osCommerce and have been reading through this site and this thread in much detail. Basically, I have a problem with my site and trying to imlpement a shared SSL and from reading this thread you appear to be an SSL GOD!

 

I have the site http://www.cutepooch.co.uk and managed to install osCommerce with no problems (even after modifying it due to Register Globals being off). However, I've contacted my host and requested an SSL only to be given a shared one with the address of https://cutepooch.ssl-01.com.

 

Am I correct in the assumption that for my site to work, I essentially need to mirror the normal site on the secure server?

 

More importantly, when I try and create an account for example, I click on 'Create Account' it then transfers me to the appropriate page on the secure server, I fill in all the details, but when I click on 'Submit' it appears to just refresh the page????

 

I've spent hours reading this forum to try and resolve the problem, but have had no success. Would you be able to offer me any advice or help?

 

If you'd like to try it for yourself, I've password protected the site while it's under contruction however the username and password are both test.

 

Cheers

[Kidz Toyz 0]

I also have an SSL problem. Having read through many posts on the subject, including the original guide to installation, I haven't found any threads with this problem on.

 

Our hosting company is Lycos. I sent them an e-mail asking if they had a shared ssl cert, and if so what do we need to do to activate it.

 

This is the response from Lycos:

 

Unfortunatly Lycos shared web hosting does not provide access to the following :

 

ROOT of the drive for program instalation.

 

Safe mode OFF is not available due to shared hosting restrictions

 

SSL access/instalation

 

Sessions PHP based (including having Globals switched off) and php.ini access.

 

CGi-Bin and products requiring a Perl database are also not supported.( unless they

can be run from a sub folder IE your hosting space )

 

ASP( Active Server Pages) is also not supported for security and stability reasons

but is available on our VDS packages (Virtual Dedicated Server).

 

You may compare our VDS prices at the following address:

 

http://webhosting.lycos.co.uk/business/comparevds/

 

Please note that these packages require a prior knowledge of Linux operating systems

and are not an UPGRADE option. VDS would require to be purchased alongside your

existing hosting, or if within the 30 cancelation or at renewal point purchased

instead of.

 

Alternativly please check the comprehensive help files for supported file types

from your Lycos control panel under PHP/MYSQL and clicking on the links:

 

PHP version: 4.3.10 (phpinfo) + 5.0.2 (phpinfo) Documentation

 

 

Having absolutely no clue as to what this means, I then asked them to explain in laymans terms and was told:

 

The Lycos system does not support the use of SSL

 

Now I'm stuck. Ours is a retail site, we need SSL.

 

Am I asking them the wrong questions & misunderstanding their reply?

Does anyone else use Lycos and have SSL installed?

If we buy a seperate certificate can we still install it?

Do we need to find a new host to be able to have SSL on our site? :'( I really don't want to do that if there's an alternative!

 

Thanks, in advance for any help.

 

Nikki

[BillinDetroit 0]

I also have an SSL problem. Having read through many posts on the subject, including the original guide to installation, I haven't found any threads with this problem on.

 

Our hosting company is Lycos. I sent them an e-mail asking if they had a shared ssl cert, and if so what do we need to do to activate it.

 

This is the response from Lycos:

 

Having absolutely no clue as to what this means, I then asked them to explain in laymans terms and was told:

 

 

Now I'm stuck. Ours is a retail site, we need SSL.

 

Am I asking them the wrong questions & misunderstanding their reply?

Does anyone else use Lycos and have SSL installed?

If we buy a seperate certificate can we still install it?

Do we need to find a new host to be able to have SSL on our site? :'( I really don't want to do that if there's an alternative!

 

Thanks, in advance for any help.

 

Nikki

 

Nikki, it looks like you asked the right question and understood the reply correctly. It doesn't appear that Lycos will grant you access to the root directory to install your own cert and wants far too much money to make that a possibility. (When I saw their scare-tactic line warning you away from Linux my thought was that if THEY understood Linux, they could do this using chroot ... grrrr! In fact, that is what it sounds like they ARE doing ... but calling VDS and charging for it. Nonsense. Takes two minutes manually and can be automated. Never needs touching afterwards.).

 

Bluehost, for about $6 / month will give you a TON more than you need. http://bluehost.com My only affiliation with them is as a satisfied customer. They seem to understand what's gong on inside that box with the little blinky lights.

[BillinDetroit 0]

:'( :'( :'( JPWeber I Need Your Help!!! :'( :'( :'(

I'm new to osCommerce and have been reading through this site and this thread in much detail. Basically, I have a problem with my site and trying to imlpement a shared SSL and from reading this thread you appear to be an SSL GOD!

 

I have the site http://www.cutepooch.co.uk and managed to install osCommerce with no problems (even after modifying it due to Register Globals being off). However, I've contacted my host and requested an SSL only to be given a shared one with the address of https://cutepooch.ssl-01.com.

 

Am I correct in the assumption that for my site to work, I essentially need to mirror the normal site on the secure server?

 

More importantly, when I try and create an account for example, I click on 'Create Account' it then transfers me to the appropriate page on the secure server, I fill in all the details, but when I click on 'Submit' it appears to just refresh the page????

 

I've spent hours reading this forum to try and resolve the problem, but have had no success. Would you be able to offer me any advice or help?

 

If you'd like to try it for yourself, I've password protected the site while it's under contruction however the username and password are both test.

 

Cheers

 

Take a look backwards at the suggestions Jason posted for using OSC on bluehost. You will need to modify two versions of configure.php just as he shows, substituting the text your ISP provided as indicated and ALSO keep an eye out for the addition of the letter 's' (changing http to https) in a couple locations.

 

Work on ONE FILE AT A TIME ... because they are NOT identical and are NOT interchangeable.

 

You almost certainly will have to use either your FTP software or your ISP's utility software to change the read and write permissions on these files. What I found was that it was a whole lot easier to download and edit the file than it was to get the web server to let me post the modified file. As there is no need for these files to be written to by anyone other than yourself and then only in an off-line editing session, leave their perms set to read only for user, group and other except for exactly and only as long as it takes to upload the changed files.

 

BTW, as to being an 'SSL god" ... I don't think so. I've done this exactly once ... and not without incident. Jason is the guy you are looking for ... HE'S the one who got ME facing straight.

 

I will point out that Jason is dead on in another regard ... you are well-advised to obtain a private SSL just to avoid that error message pointed to a couple of posts back. If you'll look at his first posting at the head of this thread, I think you'll find that it is not much more complicated to obtain and use a private SSL certificate than it is to use a shared one.

[BillinDetroit 0]

Gack! I'm blind. Jason ... feel free to correct my post as necessary.

36 POINT RED LETTERS and I somehow never noticed!

 

Ack, cough, hack, whirrrr, thbbt! I think I'm about to spit a hairball!

[jpweber 8]

so its no big deal for my main admin page not to be secure

 

No. What could a hacker do from your admin/index.php page? They can't do a thing from there. Just make sure your pages say https:// once you click on one of the links. It's always a wise idea to change the name of your /admin/ folder to something else of your choice, because all hackers know that if it's an OSC site, /admin gets you to the administration. All you do is change the folder name and replace all occurrences of /admin/ in you admin/includes/configure.php page to whatever you called it.

[jpweber 8]

Now I'm stuck. Ours is a retail site, we need SSL.

 

Am I asking them the wrong questions & misunderstanding their reply?

Does anyone else use Lycos and have SSL installed?

If we buy a seperate certificate can we still install it?

Do we need to find a new host to be able to have SSL on our site? :'( I really don't want to do that if there's an alternative!

 

Thanks, in advance for any help.

 

Nikki

 

Well, Nikki, they pretty much laid it out for you. They don't have the abilities to install either a shared SSL or a private SSL. They gave you a link to their dedicated servers in case you want active server pages (.asp), but OSC is a .php based program that doesn't use active server pages. So it's time to look for a new host. E-mail me for recommendations if you'd like.

[jpweber 8]

:'( :'( :'( JPWeber I Need Your Help!!! :'( :'( :'(

I'm new to osCommerce and have been reading through this site and this thread in much detail. Basically, I have a problem with my site and trying to imlpement a shared SSL and from reading this thread you appear to be an SSL GOD!

 

I have the site http://www.cutepooch.co.uk and managed to install osCommerce with no problems (even after modifying it due to Register Globals being off). However, I've contacted my host and requested an SSL only to be given a shared one with the address of https://cutepooch.ssl-01.com.

 

If you'd like to try it for yourself, I've password protected the site while it's under contruction however the username and password are both test.

 

Cheers

 

Steve, it appears that you have your includes/configure.php file set incorrectly. Not the "Error!

 

Unable to determine the page link!" at the bottom. My hunch is that you have an incorrect path to your secure folder. I'll explain. Here's somebody's configure.php, and I'll substitute your path:

 

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://woodburnerwarehouse.ie'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://cutepooch.ssl-01.com/~USERNAME'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

Not the "Username" in bold. It appears your host left you out. Most hosts use your FTP login for your shared SSL username, but I'm not sure which host you're with. Check with your host and ask them for the path to Shared SSL. Once they give you the accurate path -- and there MUST be something after https://cutepooch.ssl-01.com, then incorporate this into your configure.php files.

 

Any troubles, let me know. Good luck.

[jpweber 8]

not = note ... sorry for the typos; happens when you're doing 10 things at once!

 

Let me know how it's working after you get the proper path to your Secure Shared SSL from your host -- WITH your username.

[poab 0]

Hi there

I have never used ssl before and would like some help.

 

I have a hosting account with fasthosts and thay have supplyed a ssl folder for me. I was told i needed to install oscommerce in both of my folders ( my http folder and my ssl folder) so I did .

( http://www.fasthosts.co.uk/knowledge-base/?article_id=916 ) is the link i was sent from fasthosts for help

 

I used the browser install for both,

 

Now my http folder is on a linux server and the ssl folder is on another server ( windows )

 

when i go to my site it works I think . Browsing the stock uses the http folder and when i go to my account or sign in page then it jumps to the https folder which i think is ok but when i try to log in with my details it doesnt work I get a page saying-

 

The directory name is invalid.

 

I think it is becouse the login directs me to - https://vault2.secured-url.com/index.php

 

i asume it sould be - https://vault2.secured-url.com/agift-foryou/index.php as this is the ssl folder

 

If it is possable could someone have a look a the site and see where i went wrong.

 

my site address is http://www.agift-foryou.com/index.php

 

Ps i do have a index.html page just a holding page so the index.php is required in the address.

 

not sure if this is the only problem so fell free to root around and create accouts if you need to.

 

Eny help on this matter would be great as this has been driving me insane for days now. Not sure if i have posted all the info need . If not I can post what ever is needed for the help

[Ausgirl 3]

Hello,

 

How does one get rid of the little pop up message that says "This page contains secure & non secure items ect..."

 

Im sure this has been answered before, Ive been looking but cannot find it.

 

Also in my admin interface it says you are protected by a unknown SSL. Is there a reason as to why it says unknown or doesnt it really matter as long as it reconizes that your protected.

 

Also in admin whenever I use my Links Manager I get the same pop up message for the secure & non secure pages.

 

My configure files are all set as stated in your description (I know they are cause you helped once before when I was having trouble with my SSL)

 

Help much appreciated

 

Thanks

[sjwdavies 0]

Steve, it appears that you have your includes/configure.php file set incorrectly. Not the "Error!

 

Unable to determine the page link!" at the bottom. My hunch is that you have an incorrect path to your secure folder. I'll explain. Here's somebody's configure.php, and I'll substitute your path:

 

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://woodburnerwarehouse.ie'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://cutepooch.ssl-01.com/~USERNAME'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

Not the "Username" in bold. It appears your host left you out. Most hosts use your FTP login for your shared SSL username, but I'm not sure which host you're with. Check with your host and ask them for the path to Shared SSL. Once they give you the accurate path -- and there MUST be something after https://cutepooch.ssl-01.com, then incorporate this into your configure.php files.

 

Any troubles, let me know. Good luck.

 

 

Hi, thanks for your help.

 

I've emailed my host (www.streamlinenet.co.uk) and they say there's nothing more to the pathway.... here's their reply:

 

 

Ticket Details. Subject: SSL Pathway

 

Hi Steven Davies,

 

Thanks for your query.

 

https://cutepooch.ssl-01.com/

 

FTP host: ftp.ssl-01.com

FTP user: cutepooch

FTP pass: ******

 

Kind Regards,

Support Department

Streamline.Net - The home of good value web hosting

 

We hope you had a nice weekend.

 

--------------------------

 

cutepooch.co.uk is registered by us.

cutepooch.co.uk is on our hosting system.

--------

 

 

Hi,

 

Please can you give me the path to the shared SSL?

 

Many thanks,

Steve

[NoelCat 0]

:thumbsup:

Hello,

 

Also in my admin interface it says you are protected by a unknown SSL. Is there a reason as to why it says unknown or doesnt it really matter as long as it reconizes that your protected.

 

 

 

I'd like to know the answer to this also as I get the same thing using Rapid SSL.

[nickspurck 0]

Hi,

I have this same problem. I have the server set up with shared SSL, and https pages work fine if you type them in directly as a URL, but as soon as you click on a link, even if it should normally be an https page (like login) you get thrown back to a standard unsecured http page. As a result, the site won't provide a secure connection to authorize.net

 

Here's what I have in my admin configure file:

define('HTTP_SERVER', 'https://cloucult.com'); // eg, http://localhost or - https://localhost should not be NULL for productive servers

define('HTTP_CATALOG_SERVER', 'https://cloucult.com');

define('HTTPS_CATALOG_SERVER', 'https://cloudcult.c2.ixwebhosting.com');

define('ENABLE_SSL_CATALOG', 'true'); // secure webserver for catalog module

 

Here's what I have in my catalog configure file:

define('HTTP_SERVER', 'http://cloudcult.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://cloudcult.c2.ixwebhosting.com'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', '.cloudcult.com');

define('HTTPS_COOKIE_DOMAIN', '.cloudcult.c2.ixwebhosting.com');

define('HTTP_COOKIE_PATH', '/catalog/');

define('HTTPS_COOKIE_PATH', '/catalog/');

define('DIR_WS_HTTP_CATALOG', '/catalog/');

define('DIR_WS_HTTPS_CATALOG', '/catalog/');

 

According to my webhost, by third level shared SSL is https://cloudcult.c2.ixwebhosting.com

 

I've been working on this problem for a good 4 hours and figure it's time to seek help.

 

Thanks

 

I have Ix Webhosting too...great cheap hoster....

Anyways, in the catalog/includes/local configure.php just flip this line in the local

define('ENABLE_SSL', 0);

to be

define('ENABLE_SSL', 1);

 

Same for the local admin...you can't rename them or your site will not work.

 

Make all the other changes that jason recommends here and you'll be golden. Your pages that don't need protected, won't be and those that do, will be.

 

Nick Spurck

[jpweber 8]

Hi there

I have never used ssl before and would like some help.

 

I have a hosting account with fasthosts and thay have supplyed a ssl folder for me. I was told i needed to install oscommerce in both of my folders ( my http folder and my ssl folder) so I did .

( http://www.fasthosts.co.uk/knowledge-base/?article_id=916 ) is the link i was sent from fasthosts for help

 

Hi Poab. I was out of town on business, so I apologize for the delay. Fasthosts.co.uk is one of the worsts hosts I've ever dealt with (via helping others). Your includes/configure.php file should look like this (if you have it on www, just put the www in there after the http://

 

// Define the webserver and path parameters
// * DIR_FS_* = Filesystem directories (local/physical)
// * DIR_WS_* = Webserver directories (virtual/URL)
 define('HTTP_SERVER', 'http://agift-foryou'); // eg, http://localhost - should not be empty for productive servers
 define('HTTPS_SERVER', 'https://vault2.secured-url.com/agift-foryou'); // eg, https://localhost - should not be empty for productive servers
 define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

Any further questions, just post.

[jpweber 8]

Hello,

 

How does one get rid of the little pop up message that says "This page contains secure & non secure items ect..."

 

This means you have an external http:// link (either a link or a linked picture) in your coding, in the page that's giving your problems. If it's not on that page, then it's in your header.php file.

 

Change it to https:// and the error will go away. Good luck.

[jpweber 8]

Hi, thanks for your help.

 

I've emailed my host (www.streamlinenet.co.uk) and they say there's nothing more to the pathway.... here's their reply:

Ticket Details. Subject: SSL Pathway

 

Hi Steven Davies,

 

Thanks for your query.

 

https://cutepooch.ssl-01.com/

 

FTP host: ftp.ssl-01.com

FTP user: cutepooch

FTP pass: ******

 

Kind Regards,

Support Department

Streamline.Net - The home of good value web hosting

 

We hope you had a nice weekend.

 

I think I read your original e-mail wrong. It sounds like you should use something like:

 

define('HTTP_SERVER', 'http://www.cutepooch.com'); // eg, http://localhost - should not be empty for productive servers
define('HTTPS_SERVER', 'https://cutepooch.ssl-01.com'); // eg, https://localhost - should not be empty for productive servers
define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

If you want, I can take a look at it myself if that doesn't work.

[jpweber 8]

Hello,

 

Also in my admin interface it says you are protected by a unknown SSL. Is there a reason as to why it says unknown or doesnt it really matter as long as it reconizes that your protected.

I'd like to know the answer to this also as I get the same thing using Rapid SSL.

 

Don't worry about this message. All you should be concerned about is that when you click one of the links from your admin tool's initial page, that it switches to https://

[jpweber 8]

I have Ix Webhosting too...great cheap hoster....

Anyways, in the catalog/includes/local configure.php just flip this line in the local

define('ENABLE_SSL', 0);

to be

define('ENABLE_SSL', 1);

 

Same for the local admin...you can't rename them or your site will not work.

 

Make all the other changes that jason recommends here and you'll be golden. Your pages that don't need protected, won't be and those that do, will be.

 

Nick Spurck

 

If you have a configure.php in your "local" folder under includes/local/configure.php then your OSC isn't even looking at your includes/configure.php!

[Ausgirl 3]

Thanks Jason,

 

It was an image problem I was having, I just deleted it & replaced it & the message is gone now. When the site first loads, Is it possible to stop the pop up message that states you are viewing a page with secure & non secure items then you click either yes /no?

 

I think this has been answered before somewhere but I cant seem to find it.

 

Thank You

[jpweber 8]

Thanks Jason,

 

It was an image problem I was having, I just deleted it & replaced it & the message is gone now. When the site first loads, Is it possible to stop the pop up message that states you are viewing a page with secure & non secure items then you click either yes /no?

 

I think this has been answered before somewhere but I cant seem to find it.

 

Thank You

 

Somewhere on the page that gives you this message, in the coding, there is an http:// ... this needs to be changed to https:// (with the extra s). It might very well be in your includes/header.php file, also. Find the http:// external link and change it to https://

 

Good luck.