SSL Question

[Mr. Waffles]

When I log on to http://www.mysite.com/oscommerce/admin I get the following error on my OScommerce Admin page in the bottom left corner.

 

"You are not protected by a secure SSL connection."

 

When I log in with https://mysite.com/oscommerce/admin it says I am "protected by an unknown secure connection"

 

What is the application of this??

When I log into Admin, to be secrure do I simply need to login through https://mysite.com/oscommerce/admin, or do I need to take further steps to protect my site?

Also, is the 'unknown' SSL connection a problem?

 

Thanks!

Lincoln

[♥Vger]

It makes no diffference if you have a full ssl installed, osCommerce will still tell you it's 'unknown'.

 

To make all of your admin folder run under https, with no entry via http, change all of the http://www.yourdomain.com entries in admin/includes/configure.php to https://www.yourdomain.com

 

You also try putting this code into the .htaccess file in your 'admin' folder, though whether it will work will depend upon how modern your system is. If it doesn't work, just remove it. Please note - this file pathway is for a full ssl cert.

 

SSLRequireSSL

ErrorDocument 403 https://www.yourdomain.com/admin/

 

Vger

[Mr. Waffles]

It makes no diffference if you have a full ssl installed, osCommerce will still tell you it's 'unknown'.

 

To make all of your admin folder run under https, with no entry via http, change all of the http://www.yourdomain.com entries in admin/includes/configure.php to https://www.yourdomain.com

 

You also try putting this code into the .htaccess file in your 'admin' folder, though whether it will work will depend upon how modern your system is.  If it doesn't work, just remove it.  Please note - this file pathway is for a full ssl cert.

 

SSLRequireSSL

ErrorDocument 403 https://www.yourdomain.com/admin/

 

Vger

<{POST_SNAPBACK}>

 

Thanks!

Does the whole admin folder need to run on SSL to be secure, or can I leave it as is?

[ozcsys]

When talking about securing your admin you do not mention having it password protected. You probably already have but if not you need to do that to keep people out. You can also change the name of your admin to make it harder for others to find it and try to access it.

[bglkk]

Thanks!

Does the whole admin folder need to run on SSL to be secure, or can I leave it as is?

<{POST_SNAPBACK}>

 

"EZ" Secure Order & Customer Viewing

 

http://www.oscommerce.com/community/contributions,2274/

 

"This contribution addresses an issue with the store admin to allow secure viewing and editing of order and customer details while allowing the rest of the admin to remain in standard mode -- alleviating unneccessary strain on the SSL server and allowing generally quicker operation of nonSSL admin functions."