SSL for the Admin Panel

[Airbus A-380]

Hi everybody ,

 

Should I enable the SSL connection for the admin panel and all the shop during installation ?

 

( means that I set https://www.mystore.com for WWW Address: and Secure WWW Address: )

 

Is it recommended ? What do you use to do ?

 

Cheers ! :thumbsup:

[kgt]

Enable SSL for both if your host has your account set up to use SSL.

[♥Monika in Germany]

... or offers free shared SSL ... no shop should be without SSL and an admin area without SSL is just plain scary!

[jpweber]

Yes, I would, and you do that in the catalog/admin/includes/configure.php file, around line 13 or so:

 

// define our webserver variables

// FS = Filesystem (physical)

// WS = Webserver (virtual)

define('HTTP_SERVER', 'http://www.yourwebsite.com');

define('HTTP_CATALOG_SERVER', 'http://www.yourwebsite.com');

define('HTTPS_CATALOG_SERVER', 'https://www.yourwebsite.com');

define('ENABLE_SSL_CATALOG', 'true'); // secure webserver for catalog module

define('DIR_FS_DOCUMENT_ROOT', $DOCUMENT_ROOT); // where your pages are located on the server. if $DOCUMENT_ROOT doesnt suit you, replace with your local path. (eg, /usr/local/apache/htdocs)

 

Now, this is assuming your SSL is set up for http://www.yourwebsite.com, not http://yourwebsite.com. You may have to take out the "www", depending on how your SSL is set up. But the main thing is that it's set to "true", and that you upload your catalog/admin/includes/configure.php file to your server using your FTP tool.

[jpweber]

oh, lol, missed that. Stephane is still talking about installation.

 

Yes, you have to purchase your SSL first. That means you have to ask your host for a CSR; tell them you want to install SSL. They'll give you the CSR and you give this to an SSL company. You then purchase the SSL, get an SSL key, and give that SSL key back to your host. Then your host will install the SSL, and THEN change your catalog/includes/configure.php file and catalog/admin/includes/configure.php files and upload them.

[Airbus A-380]

Thanks for your prompt reply. :) I take care of your advise.

 

Regards ,

 

St?phane

[jpweber]

Yes, and I made a minor mistake, too, Stephane ... when you finallly do get your SSL, you

 

1) Secure your website by going to catalog/includes/configure.php, and adjusting the configure.php file.

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.yourwebsite.com');

define('HTTPS_SERVER', 'https://www.yourwebsite.com');

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'http://www.yourwebsite.com');

define('HTTPS_COOKIE_DOMAIN', 'https://www.yourwebsite.com');

 

2) Secure your ADMIN by going to catalog/admin/includes/configure.php and changing it to this:

// define our webserver variables

// FS = Filesystem (physical)

// WS = Webserver (virtual)

define('HTTP_SERVER', 'https://www.yourwebsite.com');

define('HTTP_CATALOG_SERVER', 'https://www.yourwebsite.com');

define('HTTPS_CATALOG_SERVER', 'https://www.yourwebsite.com');

define('ENABLE_SSL_CATALOG', 'true'); // secure webserver for catalog module

define('DIR_FS_DOCUMENT_ROOT', $DOCUMENT_ROOT); // where your pages are located on the server. if $DOCUMENT_ROOT doesnt suit you, replace with your local path. (eg, /usr/local/apache/htdocs)

 

Note that I put an "https://" (with the "S") after all of them on the ADMIN side.

 

Also, when you buy your SSL, make sure you take note whether you buy it for http://www.yourdomain.com, or http://yourdomain.com, and adjust your configure files accordingly. Then simply upload them to your server and you're secure. Good luck.