SSL Implementation Help

[quentong]

Being quite hammered by the infamous IE "secure and non-secure items..." popup. All works fine on FF, Safari, etc but not Explorer. Trying to help a friend move his oscommerce websites. Have them on a shared hosting environment at Godaddy. The one in root works fine but second site which is located in a subdirectory has IE problem. Read for many hours and tried various fixes for many more hours. Still no joy.

 

In application top, have tried...

 

$request_type = ($_SERVER['SERVER_PORT'] == HTTPS_SERVER_PORT) ? 'SSL' : 'NONSSL';

$request_type = (getenv('HTTPS') == '1') ? 'SSL' : 'NONSSL';

$request_type = ($_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL';

$request_type = (getenv('SERVER_PORT') == '443') ? 'SSL' : 'NONSSL';

 

Here is includes/config.php

<?php

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.sendacelebration.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTP_CATALOG_SERVER', 'http://www.sendacelebration.com');

define('HTTPS_CATALOG_SERVER', 'https://www.sendacelebration.com');

define('ENABLE_SSL_CATALOG', true); // secure webserver for catalog module

//define('DIR_FS_DOCUMENT_ROOT', $DOCUMENT_ROOT); // where the pages are located on the server

define('DIR_FS_DOCUMENT_ROOT', '/home/content/00/7954900/html'); // where the pages are located on the server

define('DIR_WS_ADMIN', '/#####/'); // # edited

define('DIR_FS_ADMIN', DIR_FS_DOCUMENT_ROOT . DIR_WS_ADMIN); // absolute pate required

define('DIR_WS_CATALOG', '/'); // absolute path required

define('DIR_FS_CATALOG', DIR_FS_DOCUMENT_ROOT . DIR_WS_CATALOG); // absolute path required

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_CATALOG_IMAGES', DIR_WS_CATALOG . 'images/');

define('DIR_WS_IMAGES_PRODUCTS', 'products/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

define('DIR_WS_CATALOG_LANGUAGES', DIR_WS_CATALOG . 'includes/languages/');

define('DIR_FS_CATALOG_LANGUAGES', DIR_FS_CATALOG . 'includes/languages/');

define('DIR_FS_CATALOG_IMAGES', DIR_FS_CATALOG . 'images/');

define('DIR_FS_IMAGES_PRODUCTS', DIR_FS_CATALOG_IMAGES . 'products/');

define('DIR_FS_CATALOG_MODULES', DIR_FS_CATALOG . 'includes/modules/');

define('DIR_FS_BACKUP', DIR_FS_ADMIN . 'backups/');

?>

 

If there is a wrong setting, missed it. Ran cfgchk.php which suggests something is not correct.

 

-----------------------------------------

 

cfgchk.php Version 1.2

File Permissions: 0604

HTTPS_SERVER undefined!

ENABLE_SSL undefined!

HTTPS_COOKIE_DOMAIN undefined!

Parsing application_top.php for SSL detection key...

 

Done!

 

-----------------------------------------

 

Also have....

 

https://www.sendacelebration.com/mybigenv.php

 

 

Any help will be greatly appreciated (and hair saving).

[germ]

Your config file is bad.

 

The one you posted is from the admin not the catalog.

 

If that truly is the catalog one it needs these mods added:

 

define('HTTP_SERVER', 'http://www.sendacelebration.com'); // eg, http://localhost - should not be empty for productive servers

//
// add the next FIVE lines in this place in the file
//
 define('HTTPS_SERVER', 'https://www.sendacelebration.com'); // eg, http://localhost - should not be empty for productive servers
 define('HTTP_COOKIE_DOMAIN', 'www.sendacelebration.com');
 define('HTTPS_COOKIE_DOMAIN', 'www.sendacelebration.com');
 define('HTTP_COOKIE_PATH', '/');
 define('HTTPS_COOKIE_PATH', '/');
//
// end of what needs added
//

[quentong]

Your config file is bad.

 

The one you posted is from the admin not the catalog.

 

If that truly is the catalog one it needs these mods added:

 

define('HTTP_SERVER', 'http://www.sendacelebration.com'); // eg, http://localhost - should not be empty for productive servers

//
// add the next FIVE lines in this place in the file
//
 define('HTTPS_SERVER', 'https://www.sendacelebration.com'); // eg, http://localhost - should not be empty for productive servers
 define('HTTP_COOKIE_DOMAIN', 'www.sendacelebration.com');
 define('HTTPS_COOKIE_DOMAIN', 'www.sendacelebration.com');
 define('HTTP_COOKIE_PATH', '/');
 define('HTTPS_COOKIE_PATH', '/');
//
// end of what needs added
//

 

 

Hello Germ,

 

Thank you most sincerely for your reply. I pasted from the wrong one (had both open). I found a solution and have it below in hopes it is useful for others. Here is includes/config.php

 

--------------------------------------------------

 

<?php /* osCommerce, Open Source E-Commerce Solutions

http://www.oscommerce.com Copyright © 2003 osCommerce

Released under the GNU General Public License */

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.sendacelebration.com/'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://www.sendacelebration.com/');

define('HTTPS_SERVER_PORT', 443);

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'www.sendacelebration.com');

define('HTTPS_COOKIE_DOMAIN', 'www.sendacelebration.com');

define('HTTP_COOKIE_PATH', '/');

define('HTTPS_COOKIE_PATH', '/');

define('DIR_WS_HTTP_CATALOG', '');

define('DIR_WS_HTTPS_CATALOG', '');

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');

define('DIR_FS_CATALOG', '');

define('DIR_FS_CACHE', DIR_FS_CATALOG . 'cache/');

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/'); // define our database connection

 

?>

 

----------------------------------------------

 

I added the line: define('HTTPS_SERVER_PORT', 443);

 

Here is the portion of application_top.php that I have...

 

----------------------------------------

 

$request_type = (getenv('SERVER_PORT') == '443') ? 'SSL' : 'NONSSL';

 

// set php_self in the local scope

if (!isset($PHP_SELF)) $PHP_SELF = $HTTP_SERVER_VARS['PHP_SELF'];

 

if ($request_type == 'NONSSL') {

define('DIR_WS_CATALOG', DIR_WS_HTTP_CATALOG);

} else {

define('DIR_WS_CATALOG', DIR_WS_HTTPS_CATALOG);

}

 

-------------------------------------

 

Doing this stopped the IE non-secure items warning.

[rrosenau]

Germ,

 

I am getting the following error on my site:

 

 

ecbiz60.inmotionhosting.com

 

Your IP is 157.93.91.85

 

My includes/configure.php looks like this:

 

define('HTTP_SERVER', 'http://www.tgidesigns.com');

define('HTTPS_SERVER', 'https://www.tgidesigns.com');

define('ENABLE_SSL', true);//secure webserver for checkout procedure

define('HTTP_COOKIE_DOMAIN', '.tgidesigns.com');

define('HTTPS_COOKIE_DOMAIN', '.tgidesigns.com');

 

 

My admin/included/configure.php looks like this:

 

define('HTTP_SERVER', 'https://www.tgidesigns.com');

define('HTTP_CATALOG_SERVER', 'https://www.tgidesigns.com');

define('HTTPS_CATALOG_SERVER', 'https://www.tgidesigns.com');

define('ENABLE_SSL_CATALOG', 'true');//secure webserver for catalog

 

Any clue on what I'm doing wrong? I bought a dedicated SSL certificate.

 

Thanks!

[germ]

I get no error on the SSL side of the site.

 

Although your category images and your SSL logo image are "M.I.A.".

[rrosenau]

I get no error on the SSL side of the site.

 

Although your category images and your SSL logo image are "M.I.A.".

 

 

Germ,

 

It appears to be working now, but how do I get the SSL logo to appear on the bottom of the page? From Comodo I got the following html, but I have no clue where to put it and don't see where it even references the image, which i have placed in /images.

 

<a href="http://www.instantssl.com">

<img src="comodo_secure-100x85.gif" alt="Instant SSL Certificate Secure Site" width="100" height="85" style="border: 0px;"><br> <span style="font-weight:bold; font-size:7pt">Instant SSL Certificate Secured</span> </a><br>

 

 

Also, on the other note, I have uploaded my product images to the server and on the product setup page where it says to add a product image it gives me no choice to browse to the folder I have on my site, it only will browse to my local hard drive and network. Do I need to map my site to a drive or something? If so how? Sorry for being such an idiot, this is all brand new to me.

 

Thanks!

[germ]

To get the SSL logo at the bottom of the page under the osc logo go to /includes/footer.php and change this code:

 

<div class="grid_24" style="text-align: center; padding-bottom: 20px;">
 <?php echo tep_display_banner('static', $banner); ?>
</div>

To this:

 

<div class="grid_24" style="text-align: center; padding-bottom: 20px;">
 <?php echo tep_display_banner('static', $banner); ?>
 <br>
 <a href="http://www.instantssl.com"><img src="images/comodo_secure-100x85.gif" alt="Instant SSL Certificate Secure Site" style="border: 0px none ;" height="85" width="100"><br>
 <span style="font-weight: bold; font-size: 7pt;">Instant SSL Certificate Secured</span> </a>
 <br>
</div>

[shahabdin]

Hi Jiim,

 

I want to know that how can I make (Create an Account Log In Contact Us) links from http to https by default I have successfully installed SSL on my store its working fine but when click above mentioned links from top navbar or footer instead going directly into https mode it goes into http mode can you help me

 

thanks

[germ]

You have to add the 'SSL' as the 3rd parameter to the tep_href_link() function.

 

An example:

 

tep_href_link(FILENAME_PASSWORD_FORGOTTEN, '', 'SSL')

Do not copy/paste this code snippet into your files.

 

It's only meant as an example for you to follow, not a replacement for your code.

[kjonmyway]

I would really appreciate any help and insight.....been racking my brain over this.

 

I uploaded the unsecure.php, and it shows fine, but i am still getting "do you want to view unsecure items"..... (screenshot attached)

 

I transferred this site from another hosting company, and purchased an SSL certificate (the old host had a shared ssl).

 

I know I am probably doing something wrong, but can't figure it out. The oscommerce installation is in www.tasteadventure.com/store/catalog

 

I don't see any non-relative image paths.

 

My configure.php file is as follows

 

 

<?php

/*

$Id: configure.php,v 1.14 2003/07/09 01:15:48 hpdl Exp $

 

osCommerce, Open Source E-Commerce Solutions

http://www.oscommerce.com

 

Copyright © 2003 osCommerce

 

Released under the GNU General Public License

*/

 

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.tasteadventure.com'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://www.tasteadventure.com'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'www.tasteadventure.com');

define('HTTPS_COOKIE_DOMAIN', 'tasteadventure.com');

define('HTTP_COOKIE_PATH', '/store/catalog/');

define('HTTPS_COOKIE_PATH', '/store/catalog/');

define('DIR_WS_HTTP_CATALOG', '/store/catalog/');

define('DIR_WS_HTTPS_CATALOG', '/store/catalog/');

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 

define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');

define('DIR_FS_CATALOG', '/public_html/store/catalog/');

(beginning of the filepath above has been removed for security reasons)

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 

// database connection information left out

 

define('USE_PCONNECT', 'false'); // use persistent connections?

define('STORE_SESSIONS', 'mysql'); // leave empty '' for default handler or set to 'mysql'

?>

[kjonmyway]

I believe I found the problem, (and hope this helps someone).

 

As I stated, I had moved hosting companies. I moved because the previous hosting company was terrible, and the site was down for weeks after they moved servers, (it was functioning great prior to them switching the files to a new server). It appears that they changed some of the oscommerce files.

 

In the application_top.php file, where it should have been:

 

// set the type of request (secure or not)

$request_type = (getenv('SERVER_PORT') == '443') ? 'SSL' : 'NONSSL';

 

They changed it to:

$request_type = (stristr(getenv('HTTP_X_FORWARDED_HOST'), ".netfirms.com")) ? 'SSL' : 'NONSSL';

 

I changed it back, and now everything seems to be ok. Hope this helps someone.

[germ]

The most common changes to application_top to get SSL to work are covered in the first post in this topic.

[jonbonse]

Hi germ!

 

I hope you will be able to assist me in a problem I believe you have resolved before but I cant seem to resolve it!

 

The problem is that SSL works on checkout pages and I get the https in the URL. But https does not appear when I click on the 'login' page or the 'create an account' page from the home page. However, the https appears in the URL when I go to the 'create an account' page from the log in page and click on 'I am a new customer - 'continue', https appears in the url. . . . . . . and same for 'log in'.

 

I can only find reference to login and create an account pages in 'navigation.php' and have amended the following with no effect:

 

$login_link = tep_href_link('login.php');

 

To

 

$login_link = tep_href_link('login.php', '', 'SSL');

 

and

 

$acc_link = tep_href_link('create_account.php');

 

To

 

$acc_link = tep_href_link('create_account.php', '', 'SSL');

 

Can you help????

 

The URL is www.bitcomm-online.co.uk

[germ]

Read the first post in this thread.

 

Your SSL isn't working correctly anywhere.

[addeaz]

Hi,

When I change this to "true" "define('ENABLE_SSL', true);" in the configure file, I cant log in as a customer into our webshop. I need to enable this for making Facebook Connect to work. Please help me with this. I have a shared SSL. that is why the https URL look like it does. When I try to log in with SSL I am just comming to "https://kameraexperten-com.loopiasecure.com" but I am not loged in.

 

Below is my configure file in http://www.kameraexperten.com/includes/

 

 define('HTTP_SERVER', 'http://www.kameraexperten.com');
 define('HTTPS_SERVER', 'https://kameraexperten-com.loopiasecure.com');
 define('ENABLE_SSL', true);
 define('HTTP_COOKIE_DOMAIN', 'www.kameraexperten.com');
 define('HTTPS_COOKIE_DOMAIN', 'kameraexperten-com.loopiasecure.com');
 define('HTTP_COOKIE_PATH', '/');
 define('HTTPS_COOKIE_PATH', '/');
 define('DIR_WS_HTTP_CATALOG', '/');
 define('DIR_WS_HTTPS_CATALOG', '/');
 define('DIR_WS_IMAGES', 'images/');
 define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');
 define('DIR_WS_INCLUDES', 'includes/');
 define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
 define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
 define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
 define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
 define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');
 define('DIR_FS_CATALOG', 'xxxxxxx');
 define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');
 define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 define('DB_SERVER', 'noserver');
 define('DB_SERVER_USERNAME', 'user');
 define('DB_SERVER_PASSWORD', 'pass');
 define('DB_DATABASE', 'noname');
 define('USE_PCONNECT', 'false');
 define('STORE_SESSIONS', 'mysql');

 

 

Below is my configure file in the admin

 

<?php
 define('HTTP_SERVER', 'http://www.kameraexperten.com');
 define('HTTPS_SERVER', 'https://kameraexperten-com.loopiasecure.com');
 define('HTTP_CATALOG_SERVER', 'http://www.kameraexperten.com');
 define('HTTPS_CATALOG_SERVER', 'https://kameraexperten-com.loopiasecure.com');
 define('ENABLE_SSL', 'true');
 define('ENABLE_SSL_CATALOG', 'true');
 define('DIR_FS_DOCUMENT_ROOT', 'xx');
 define('DIR_WS_ADMIN', '/styling/');
 define('DIR_FS_ADMIN', 'xx');
 define('DIR_WS_CATALOG', '/');
 define('DIR_FS_CATALOG', 'xx');
 define('DIR_WS_IMAGES', 'images/');
 define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');
 define('DIR_WS_CATALOG_IMAGES', DIR_WS_CATALOG . 'images/');
 define('DIR_WS_INCLUDES', 'includes/');
 define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
 define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
 define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
 define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
 define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');
 define('DIR_WS_CATALOG_LANGUAGES', DIR_WS_CATALOG . 'includes/languages/');
 define('DIR_FS_CATALOG_LANGUAGES', DIR_FS_CATALOG . 'includes/languages/');
 define('DIR_FS_CATALOG_IMAGES', DIR_FS_CATALOG . 'images/');
 define('DIR_FS_CATALOG_MODULES', DIR_FS_CATALOG . 'includes/modules/');
 define('DIR_FS_BACKUP', DIR_FS_ADMIN . 'backups/');
 define('DB_SERVER', 'Xx');
 define('DB_SERVER_USERNAME', 'xx');
 define('DB_SERVER_PASSWORD', 'xx');
 define('DB_DATABASE', 'xx');
 define('USE_PCONNECT', 'false');
 define('STORE_SESSIONS', 'mysql');
?>

 

Have a great New Year everyone!

 

Cheers

Andreas

[germ]

The HTTPS_COOKIE_DOMAIN is wrong.

 

Try this:

 

  define('HTTPS_COOKIE_DOMAIN', '.loopiasecure.com');

 

But you have other problems.

 

The store isn't recognizing that SSL is "on", it happens a lot with shared SSL.

 

In the second post in this thread is a link to a contribution I wrote to help fix this.

 

Download it, unzip it, and upload the files to your shop.

 

Then let me know so I can access them and see what we need to change.

[addeaz]

Hi,

Thank you for your help, I did the cookie change!

The contribution is installed, hard for me to see if it tells that something is wrong:)

 

When I try to log in to the website and SSL is on, I'm landing to this page "https://kameraexperten-com.loopiasecure.com/index.php", but Im not loged in to the site. When SSL is off I get logged in as normal.

 

 

Thank you for helping!

 

Best Regards

Andreas

[germ]

In /includes/application_top.php change this code:

 

  $request_type = (getenv('SERVER_PORT') == 'on') ? 'SSL' : 'NONSSL';

 

To:

 

  $request_type = (getenv('SERVER_PORT') == '443') ? 'SSL' : 'NONSSL';

[addeaz]

Hi Germ,

Great that fixed the problem......big thanks, you are the best!!

 

Best Regards

Andreas

[germ]

I'm glad the SSL part is working.

 

Just an "FYI" your iframe to facebook is giving the infamous "non secure items" popup in IE.

 

You can't load content (images, scripts, iframes, etc.) from http sources on https pages.

[addeaz]

Hi again Germ,

Ok, so it is that iframe that gives me that popup in IE, thanks for that information. :)

 

- Is it possible to adjust this in the script so I skip that infamous popup and still can show the Facebooks likes? Maybe is it possible to load that frames script from a https Facebook source?

- This popup is shown at all SSL active pages, how do I turn of SSL in some of the pages (I dont like that the shared URL is shown more than necessary)

 

Best regards

Andreas

[addeaz]

Hi :)

I did notice that I could change the likebox URL to https fairly easy. So the pop up is gone:)

 

Now I will see if I find out how to get the checkout page non SSL.

 

Best Regards

Andreas

[germ]

Your "LiveZilla.net Chat Button Link Code" is still giving the "unsecure content" warning in IE.

 

There is a post in this thread that shows how to not display "unsecure" content on SSL pages if you look.

[addeaz]

Hi Germ,

Thanks again, I fixed that one too (on my live site).

 

SSL is on and it works, something is a bit strange though;

 

When I enter the pages where SSL is turned on, the web site get a bit smaller, the texts, frames and so on. Not much, but it is noticable.

 

Please help me if you have any clue about this one:)

 

Cheers,

 

Best Regards

Andreas

[germ]

Now your "Online Support" button/code is giving the "unsecure items" pop-up.