How to install SSL on OSC: A Simple 1-2-3 Instruction

[Guest]

I think I read your original e-mail wrong. It sounds like you should use something like:

 

define('HTTP_SERVER', 'http://www.cutepooch.com'); // eg, http://localhost - should not be empty for productive servers
define('HTTPS_SERVER', 'https://cutepooch.ssl-01.com'); // eg, https://localhost - should not be empty for productive servers
define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

If you want, I can take a look at it myself if that doesn't work.

 

Hi Jason, thanks for your reply. However since we last spoke, i've changed hosts and am really pleased with my new host. No such problems as the above, and now I have the https address of https://www.cutepooch.co.uk :lol:

[NoelCat]

define('BOX_CONNECTION_PROTECTED', 'You are protected by a %s secure SSL connection.');
define('BOX_CONNECTION_UNPROTECTED', 'You are <font color="#ff0000">not</font> protected by a secure SSL connection.');
define('BOX_CONNECTION_UNKNOWN', 'RapidSSL');

Hello,

 

Also in my admin interface it says you are protected by a unknown SSL. Is there a reason as to why it says unknown or doesnt it really matter as long as it reconizes that your protected.

 

 

Thanks

 

 

Ruth : I found that you can replace the text in that box saying "unknown" with the actual name of your SSL provider. There's probably a list of providers somewhere that doesn't include some of the smaller ones, so just putting in the name of the one I use (RapidSSL) made me feel better !

[ingrit]

HI,

I am diging on that forum for over a week now and Ican't find an answer.

I have the same proble with SSL as Poab.

My web hosting is streamline .net

The SSL path is https://vault2.secured-url.com/INGRITCRAFTS

 

My includes/configur.php file looks like that:

 

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.ingritcrafts.co.uk'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://vault2.secured-url.com/INGRITCRAFTS'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'www.ingritcrafts.co.uk');

define('HTTPS_COOKIE_DOMAIN', '');

define('HTTP_COOKIE_PATH', '/');

define('HTTPS_COOKIE_PATH', '/');

define('DIR_WS_HTTP_CATALOG', '/');

define('DIR_WS_HTTPS_CATALOG', '/');

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 

define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');

define('DIR_FS_CATALOG', '/home/fhlinux180/i/ingritcrafts.co.uk/user/htdocs/');

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 

When I am just jumping over the shop everything looks fine

http://www.ingritcrafts.co.uk/index.php

 

but as soon as I am trying to log in I see this error :

https://vault2.secured-url.com/INGRITCRAFTS...65a9733a925fa26

 

I found this today ,it was posted by Vger:

"Streamline are resellers of Fasthosts web space, and you will never get their shared ssl to work with osCommerce."

If that is true what do I need to do now?

I thought I am nearly finishing my shop and I would be able to go live.

That thing is driving me crazy ,please do help me :'(

Kind regards

Ingrit

[Ausgirl]

define('BOX_CONNECTION_PROTECTED', 'You are protected by a %s secure SSL connection.');
define('BOX_CONNECTION_UNPROTECTED', 'You are <font color="#ff0000">not</font> protected by a secure SSL connection.');
define('BOX_CONNECTION_UNKNOWN', 'RapidSSL');

 

 

Ruth : I found that you can replace the text in that box saying "unknown" with the actual name of your SSL provider. There's probably a list of providers somewhere that doesn't include some of the smaller ones, so just putting in the name of the one I use (RapidSSL) made me feel better !

 

Hi Craig,

 

Did you stick the above code in admin/boxes?

 

Your right it may not do anything but it does make you feel better.

 

:)

[NoelCat]

Hi Craig,

 

Did you stick the above code in admin/boxes?

 

Your right it may not do anything but it does make you feel better.

 

:)

 

 

Oops. sorry. Forgot to say where that area was. It's in the admin/includes/languages/english/index.php

[Ausgirl]

Oops. sorry. Forgot to say where that area was. It's in the admin/includes/languages/english/index.php

 

Thanks Craig,

 

It looks so much better now.

 

Thanks :)

[Guest]

I tried to send you a PM but, your box is full.

[Bertsu]

This means you have an external http:// link (either a link or a linked picture) in your coding, in the page that's giving your problems. If it's not on that page, then it's in your header.php file.

 

Change it to https:// and the error will go away. Good luck.

 

Hello Jason,

 

I am having the same problem, but my situation is different. I can't change the normal http links to https to fix the unsave error pop-up cos they will not work anymore (they are all different external links). The problem of getting the unsave items popup is only after the client pays and returns to my checkout-succes screen and presses "continue" He is being redirected to https://www.mysite.com/index.php and ofcourse here the problems starts. I'm afraid some customers will freak out and hit do a creditcard chargeback.

 

Is there anyway to fix this. Can you exclude some parts in my case images/links from SSL. Or can i change the link continue on the checkout succes page to httP and not https?

[dp1726]

Jason or anybody else.

I need a little help.

I added a SSL cert with dedicated server

 

With define('ENABLE_SSL', true) I cannot log into account

Create an account

or Password forgotten? Click here. get a new one

says cannot find email.

 

If i set ENABLE to false no problems.

 

I think I have tried all combinations of / . https http ect.

I'm at the point of eye failure and confusion

 

define('HTTP_SERVER', 'http://dpglassblowing.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://dpglassblowing.com'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'www.dpglassblowing.com');

define('HTTPS_COOKIE_DOMAIN', 'www.dpglassblowing.com');

define('HTTP_COOKIE_PATH', '/catalog');

define('HTTPS_COOKIE_PATH', '/catalog');

define('DIR_WS_HTTP_CATALOG', '/catalog/');

define('DIR_WS_HTTPS_CATALOG', '/catalog/');

 

 

define('HTTP_SERVER', 'https://dpglassblowing.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTP_CATALOG_SERVER', 'https://dpglassblowing.com');

define('HTTPS_CATALOG_SERVER', 'https://dpglassblowing.com');

define('ENABLE_SSL_CATALOG', true); // secure webserver for catalog module

 

// define our database connection

define('DB_SERVER', 'mysql.dpglassblowing.com'); // eg, localhost - should not be empty for productive servers

define('DB_SERVER_USERNAME', 'xxxxxxx');

define('DB_SERVER_PASSWORD', 'xxxxxxx');

define('DB_DATABASE', 'osc');

define('USE_PCONNECT', 'false'); // use persisstent connections?

define('STORE_SESSIONS', ''); // leave empty '' for default handler or set to 'mysql'

 

 

Any ideas

PS Still working on store layout.

I'm good at glass

but not this PHP stuff

 

Dave

[dp1726]

EUREKA spelling??

 

I found the problem

 

I added www. in front

 

went from

define('HTTP_SERVER', 'http://dpglassblowing.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://dpglassblowing.com'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

to

 

define('HTTP_SERVER', 'http://www.dpglassblowing.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://www.dpglassblowing.com'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

 

This also solved the problem of the Pop UP Box nor secure site ect.

 

Dave

dpglassblowing.com/catalog

[sbuell20]

I followed all the steps, but mine is still not working, can someone help, my website is SatWholesale.com. Thanks!!!

[Guest]

My problem is that I seem to have lost my SSL capability. :blink:

 

It was working and now it aint. >_<

 

I have never set up SSL before and although I 'think' (i.e. presume) that I understand what's happened, I would like to seek other's advice/comments before I go and screw things up even more (i.e. make a bad situation much worse).

 

OK .. the long-winded facts...

 

I downloaded the package - read the manual - and followed the instructions. I cleared out the old insecure database I had on the public server and left mySQL empty. During the install everything went fine, it seemed to all work, installed the database etc... and when it confirmed during the install routine that everythign was fine I followed the link to the admin pages and set about getting rid of the sample data and configuring with some test stuff of my own.

Now sometime between the install routine setting up the database and the end-point above, I had been presented with a screen which read "this looks like the first time you have been here... lets create your SSL certificate". (I presumed it was part of the osCommerce install routine (and frankly was very impressed with how smooth and seemless it all appeared to be) I filled in lots of stuff about my location and the location of the servers and all seemed OK.

The next morning I was playing around the site and admin when I 'lost' the small nationality flags for the languages plus a couple of other images (e.g the cart one). After trying various chmod options I couldn't get the images to display... so being lazy... and seeing how smoothly it had all gone before I backed up the database and reinstalled from the package only without asking it to create a new database. Voila I had the images..... BUT ... I now no longer can log into the site using SSL .. which means that nobody can create an account for themselves,etc.

 

That's where I am today (bar all the faffing about as I enterred the learning curve for SSL which, as written above, I have had no previous experience of)

 

Questions:

1: I now presume that the SSL creation step in the original installation (which step I can't recreate) was not part of the osCommerce install and was actually a script run by my hostsite? (Yes/No to 'is it part of the regular install'... has everyone else seen this stage/step)

 

2: If 'No' above... would the fact that I restored the database invalidate a SSL certificate (wouldn't have thought so otherwise regular backups would cause the same effect)

 

3: If 'Yes' to 1: How do I force the recreation of the original "lets create your SSL certificate" step?

 

4: Again (if 'No' to 1) ...are SSL's unique to even the calling URL ... for example if I connect to the site using a framed URL klokwurxestore.co.uk which I registered after the install, and which has been set-up on with the hosts as a framed redirect pointing to the default 'klokwurx.co.uk/catalog/' invalidate the SSL-certificate (which was created during the default install, so possibly has, embedded within it, the latter address)?

 

Finally, ... does all the above sound/read as if I need to start from scratch again with another empty database, but this time point the oscommerce install addresses to the framed klokwurxestore rather than the 'actual' server location of klokwurx/catalog?

 

Sorry for the length of this.... just wanted to be clear about my confusion and what happened.

 

Thanks

 

Ian

[terrylove]

Dear Jason,

I've an SSL certificate on a subdomain of my website that provides SSL to the main domain. I'm currently building a parallel store to replace my exisiting one. It will be on the same domain under a different subdirectory.

Https doens't work on the new store in catalog or admin - it works fine on the original store - for the last 4 years. Peculiarly, https doesn't seem to work on anything but the subdirectory that the original store is on.

I notice that in the original store installation in /includes/configure.php there are references to HTTPS_CATALOG_SERVER but not in the new install. Do these need to be in the new configure.php?

I welcome your thoughts and advice!

Terry

www.praxiseducation.com

 

Special note to shared SSL users, in particular bluehost users. Now I don't really recommend Shared SSL, although it's worked for many. I'd prefer the real thing. Anyway, with bluehost, your config files would look like this (note: "username" refers to the username given to you by Bluehost):

 

Includes/Configure.php:

define('HTTP_SERVER', 'http://www.yoursite.com');

define('HTTPS_SERVER', 'https://secure.bluehost.com/~username');

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', '.yoursite.com');

define('HTTPS_COOKIE_DOMAIN', 'secure.bluehost.com/~username');

 

Admin/Includes/Configure.php:

define('HTTP_SERVER', 'https://www.yoursite.com');

define('HTTP_CATALOG_SERVER', 'https://www.yoursite.com');

define('HTTPS_CATALOG_SERVER', 'https://secure.bluehost.com/~username');

define('ENABLE_SSL_CATALOG', 'true'); // secure webserver for catalog module

 

As is any case with Shared SSL, you'll have to contact your host for the proper configure files, but a simple google search will help, seeing as that many users using the same Shared SSL have already installed OSC beforehand, and have posted about it. So search the web, or call your host -- but if you're going through Bluehost, you already know now. Good luck!

[qwan]

That was good guide.

Thanks

But doesnt solve my problem. I have a shared ssl on my server and i wanted to use that first. But what i am not able to find is. Is where should i upload the files if i want my to enable ssl. I had enables ssl earlier and when i go to sign up or login it goes to https and i get file not found.

I am not sure wether i am supposed to keep two copies of my files i.e. is one is root folder and one in the ssl folder.

If i want my entire site to be in ssl then what should i do. Where do i upload the files.

 

Thank you

[Kyrsten]

Yes, Danielle. Follow my instructions. E-mail them and ask them to generate a CSR (certificate signing request) for you. If they ask you anything else, just say, "Nope, please e-mail me the CSR at your earliest convenience." .....

 

Then, go to a solid SSL company. I'm not allowed to recommend anything, because that's solicitation, so you'll have to e-mail me if you want a recommendation. I know of a few good ones out there for 15 bucks. You'll then, as the original post says, contact the SSL company and you'll e-mail them the CSR that your host, eonhost.com, generated for you. They'll ask for a payment and generously offer you an SSL certificate key, which you'll pass back to your host and ask them to install it for you.

 

Now, when you buy your SSL, make sure you tell them you want the "www" or you don't want the "www". It really doesn't matter. Just tell them you want the certificate assigned to WWW.dannislingerie.com, NOT dannieslingerie.com. When it comes time for your host to install the SSL certificate key that the SSL company generated for you, also, make sure they install the SSL on WWW.dannislingerie.com, NOT dannislingerie.com.

 

Make sense? Any more questions, feel free to ask.

 

I have one, though. Who is this Danny guy and why does he have such an array of lingerie? ;) ... hehe

 

Good luck.

 

 

Ok, I am having a similar problem that I have been trying to resolve for 3 days now to no avail, hopefully you can help me. I have supposedly a free SSL cert through my host. I have the key, the CRT and the CSR, all of which was self generated through my Cpanel in a SSL section they have to do this process. When I contacted my host via a support request asking for a secure server name to put in my config file they told me I have to purchase a dedicated server for $99 a year. When I went to live help I explained what I was trying to do again and was told that the SSL is only valid if I purchase a static domain name for $2.50 a month. After having gotten 2 completely different answers from my host I opted to look elsewhere and pay. I signed up and bought TurboSSL through GoDaddy. Everything seemed to go fine, before doing so I called GoDaddy and asked about if purchasing a dedicated server or a static domain name and the person I spoke with told me know, and then went and double checked with someone else to verify it. So I went ahead about bought the Turbo SSL and now I am stuck and have been for 3 days because GoDaddy is waiting on a response from my host, since they are who is listed on a whosi search for administrative contact on my site and not me, even though I didn't request private domain registration and when I registered indicated the opposite that I wanted it to be me and provided my information. My host has yet to reply, on Friday I put in another support request asking if the email address that GoDaddy has contacted and is waiting to hear from is in fact a manned email address and not just an auto generated one. I was informed that it is in fact a human response email address so I continued to inquire to them with what I was trying to do and waiting on a reply for in hopes to get them to reply to GoDaddy. The supposed tech support replied to my thread by giving me a login and password to the DNS and told me to change the information on the shois listing and nothing more. GoDaddy still hasn't heard anything back and I am nothing short of ticked and impatient, as my merchant requires SSL be in place within 15 days of my opening the account or they will close it on me and I have to reapply all over again and the days are quickly ticking away. Do I REALLY need either a static IP or a dedicated server for the self signed shared SSL to work? I dont mind buying something if I actually need it, but my host, AN Hosting which is just a reseller for MidPhase and everything for contact and support is actually through MidPhase giving me different answers and GoDaddy telling me I don't need those things has me completely confused. Any assistance is greatly appreciated!

[Jaide]

Jason - you're brilliant! Mind sharing some of that? :)

 

I installed SSL, did your steps, everything works. Except a couple of little things:

 

For "httpS://" pages, the link shows fine in the status bar, but when it loads, a redirect error .. and the address bar says "http://"

 

Also, my http://WWW.mysite.com/admin OR httpS://WWW.mysite.com/admin both load redirect problems?

 

Actually, it is any WWW.mysite.com that loads this:

 

The page isn't redirecting properly

 

 

 

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

 

 

 

 

 

* This problem can sometimes be caused by disabling or refusing to accept

cookies.

[Jaide]

^ It seems that all my httpS://www. pages have the redirect error and all httpS://myite.com works fine.. which is weird since I had the SSL for WWW.mysite.com >_<

[Guest]

^ It seems that all my httpS://www. pages have the redirect error and all httpS://myite.com works fine.. which is weird since I had the SSL for WWW.mysite.com >_<

It is possible that the server config file is not set up to alais the "www".

[Jaide]

It is possible that the server config file is not set up to alais the "www".

 

What does that mean? Sorry to sound so. . general

[Jaide]

Little problem (seems like the only problem left :D) ... During the checkout process.. the 'Continue' button links to:

https://mysite.com/https://mysite.com/CHECKOUTPAGESURLhere.php ... and I can't figure out why or where to change this without breaking anything else

 

EDIT: It is all the Continue buttons that are on secure pages

[peakay]

OK, newbie here. I've been reading about this and also doing searches. This info is really helpful.

 

My issue: I'm using yahoo web hosting (i know the issues and drawbacks, so please don't post on this) and for shared ssl, it has me put files into a /ssl/ folder, but the server path to this is: https://s.hostingprod.com/@plasticover.com/ssl/

 

Yes, I have read the Dr. Bussom pdf on this located here: http://www.natural-health-doctor.com/install/ but I do not wish to host the entire store in ssl and tolerate the ugly urls for everything. if i use oscommerce, i wish to use it for my whole site. I don't mind the ugly urls in the secure areas (yahoo stores even switches servers), but cannot have them throughout the site.

 

How do I keep my site under non ssl for the unsecure pages, but have login, checkout, etc. appear under ssl? Do I maintain 2 complete copies of the store?

 

The test install is located here: http://www.plasticover.com/catalog/index.php and i tested moving some secure files like login.php under the ssl folder anc correctly setup the path, but I get blank pages like at this url: https://s.hostingprod.com/@plasticover.com/...talog/login.php

 

Is it because there are other include files, content, etc. it is looking for within ssl/catalog?

 

Again, do I need to move only certain files under ssl/catalog or do I need to have 2 identical /catalog directory and contents with one at the site root and one in /ssl/catalog?

 

Thanks in advance for the noob help. I am really enthused about oscommerce and all the fgreat contributions/support i see here but for various reasons cannot leave yahoo web hosting at this time.

 

thanks!

[spiritalan]

OK, newbie here. I've been reading about this and also doing searches. This info is really helpful.

 

My issue: I'm using yahoo web hosting (i know the issues and drawbacks, so please don't post on this) and for shared ssl, it has me put files into a /ssl/ folder, but the server path to this is: https://s.hostingprod.com/@plasticover.com/ssl/

 

Yes, I have read the Dr. Bussom pdf on this located here: http://www.natural-health-doctor.com/install/ but I do not wish to host the entire store in ssl and tolerate the ugly urls for everything. if i use oscommerce, i wish to use it for my whole site. I don't mind the ugly urls in the secure areas (yahoo stores even switches servers), but cannot have them throughout the site.

 

How do I keep my site under non ssl for the unsecure pages, but have login, checkout, etc. appear under ssl? Do I maintain 2 complete copies of the store?

 

The test install is located here: http://www.plasticover.com/catalog/index.php and i tested moving some secure files like login.php under the ssl folder anc correctly setup the path, but I get blank pages like at this url: https://s.hostingprod.com/@plasticover.com/...talog/login.php

 

Is it because there are other include files, content, etc. it is looking for within ssl/catalog?

 

Again, do I need to move only certain files under ssl/catalog or do I need to have 2 identical /catalog directory and contents with one at the site root and one in /ssl/catalog?

 

Thanks in advance for the noob help. I am really enthused about oscommerce and all the fgreat contributions/support i see here but for various reasons cannot leave yahoo web hosting at this time.

 

thanks!

 

Hello peakay,

I have osCommerce on Yahoo webhosting also. There are some modifications that can be done so that you can limit the use of SSL to only unsecure infomation that NEEDS to be secure.

 

However, Yahoo has been a pain in this area. I have had my site for about three years and I am still working on trying to get Admin to work properly with added contributions in SSL. Right now I think it is only the added contributions that give me trouble. For example I have SPPC (Separate Pricing Per Customer) and it works fine except when in Admin I click the sorting arrows is goes to a Yahoo "Sorry, the page you requested was not found." For some reason the part of the url (the secure server, https) is not showing up in the address bar. The link is incomplete. A workaround is I can copy the secure server information into address bar completing the full address and then it works.

 

Nevertheless, the store operates great. If you would like to pursue this further and see what I have done using SSL with Yahoo, reply to this thread.

Alan

[Kyrsten]

OK, after 3 weeks of screwing around with my host and GoDaddy who issued my SSL they finally got it installed, even though I requested it be installed with the www, the host apparently ignored this part of my request.

 

When I go to my regular domain, which is what I have submitted to the serach engines, http://www.collegenuthut.com my site is wiped out

 

The host gives me this link for my secure site: https://collegenuthut.com but my pics and all links bring me to a 404 and all I have is the main page.

 

What am I doing wrong?

[Kyrsten]

Ok, well after several phone calls to GoDaddy and several discussions with my host it seems as everything is secure. When you login and go to my account and the checkout process it all shows https, the rest of the site no longer has broken links and images, BUT the only thing I am having a problem with is there is no lock symbol on IE, it shows briefly while the page loads then disappears once it is loaded, although I can click on where it is supposed to be after the page loads even though the lock image itself is not there and bring up the cert info. On Firefox the lock symbol shows with a forward slash through it indicating it is not secure even though it is an https showing in the address bar. What do I need to do to fix so the lock symbols show properly?

[jpweber]

Ok, well after several phone calls to GoDaddy and several discussions with my host it seems as everything is secure. When you login and go to my account and the checkout process it all shows https, the rest of the site no longer has broken links and images, BUT the only thing I am having a problem with is there is no lock symbol on IE, it shows briefly while the page loads then disappears once it is loaded, although I can click on where it is supposed to be after the page loads even though the lock image itself is not there and bring up the cert info. On Firefox the lock symbol shows with a forward slash through it indicating it is not secure even though it is an https showing in the address bar. What do I need to do to fix so the lock symbols show properly?

 

GoDaddy is a really strange host. Link please?