Shared SSL and Config Files

[Mort-lemur]

Hi,

 

Im setting up a new site and using the hosts shared SSL - and getting the config files right is driving me nuts - as all my other sites use their own SSL which are quite straight forward but shared ssl config seems to have beaten me......

 

The ssl works - but something in the cookies / sessions is causing the store to lose its cart contents when hitting the checkout button - ie when it moves from non-ssl to ssl pages.

 

My Config files are set as follows:

 

Store:

  define('HTTP_SERVER', 'http://www.mysite.co.uk');
  define('HTTPS_SERVER', 'https://otter.xssl.net/~myusername');
  define('ENABLE_SSL', true);
  define('HTTP_COOKIE_DOMAIN', '');
  define('HTTPS_COOKIE_DOMAIN', '');
  define('HTTP_COOKIE_PATH', '/');
  define('HTTPS_COOKIE_PATH', '/');
  define('DIR_WS_HTTP_CATALOG', '/');
  define('DIR_WS_HTTPS_CATALOG', '/');
  define('DIR_WS_IMAGES', 'images/');

Admin:

  define('HTTP_SERVER', 'http://www.mysite.co.uk');
  define('HTTP_CATALOG_SERVER', 'http://www.mysite.co.uk');
  define('HTTPS_CATALOG_SERVER', 'https://otter.xssl.net/~myusrename');
  define('HTTPS_SERVER', 'https://otter.xssl.net/~myusername');
  define('ENABLE_SSL_CATALOG', 'true');
  define('DIR_FS_DOCUMENT_ROOT', '/home/myusername/public_html/');
  define('DIR_WS_ADMIN', '/Adminname/');
  define('DIR_FS_ADMIN', '/home/myusrename/public_html/Adminname/');
  define('DIR_WS_CATALOG', '/');
  define('DIR_WS_HTTPS_CATALOG', '/');
  define('DIR_FS_CATALOG', '/home/myusername/public_html/');
  define('DIR_WS_IMAGES', 'images/');

Can anyone spot any glaring errors?

 

Many Thanks

[♥Gyakutsuki]

Do you tried in configutation (admin) to change the session config. ? (directory session).

[Jack_mcs]

Heather: For the shop side, change

  define('HTTP_COOKIE_DOMAIN', '.');
  define('HTTPS_COOKIE_DOMAIN', '');

to

  define('HTTP_COOKIE_DOMAIN', '.www.mysite.co.uk');
  define('HTTPS_COOKIE_DOMAIN', '.otter.xssl.net/~myusername');  

You also have to make the DIR_FS_CATALOG definition, which you don't show, is set to '/home/myusrename/public_html/'.

 

For the admin, change this

  define('HTTP_SERVER', 'http://www.mysite.co.uk');
  define('HTTP_CATALOG_SERVER', 'http://www.mysite.co.uk');
  define('HTTPS_CATALOG_SERVER', 'https://otter.xssl.net/~myusrename');
  define('HTTPS_SERVER', 'https://otter.xssl.net/~myusername');
  define('ENABLE_SSL_CATALOG', 'true');
  define('DIR_FS_DOCUMENT_ROOT', '/home/myusername/public_html/');
  define('DIR_WS_ADMIN', '/Adminname/');
  define('DIR_FS_ADMIN', '/home/myusrename/public_html/Adminname/');
  define('DIR_WS_CATALOG', '/');
  define('DIR_WS_HTTPS_CATALOG', '/');

to

  define('HTTP_SERVER', 'https://otter.xssl.net');
  define('HTTP_CATALOG_SERVER', 'https://otter.xssl.net');
  define('HTTPS_CATALOG_SERVER', 'https://otter.xssl.net');
  define('ENABLE_SSL_CATALOG', 'true');
  define('DIR_FS_DOCUMENT_ROOT', '/home/myusername/public_html/');
  define('DIR_WS_ADMIN', '/~myusername/Adminname/');
  define('DIR_FS_ADMIN', '/home/myusername/public_html/Adminname/');
  define('DIR_WS_CATALOG', '/~myusername/');
  define('DIR_WS_HTTPS_CATALOG', '/~myusername/');

[Mort-lemur]

@@Jack_mcs Thanks Jack, But no luck with that, when I change

define('HTTP_COOKIE_DOMAIN', '');
define('HTTPS_COOKIE_DOMAIN', '');

to

define('HTTP_COOKIE_DOMAIN', '.www.mysite.co.uk');
  define('HTTPS_COOKIE_DOMAIN', '.otter.xssl.net/~myusername');  

I get a cookies are not enabled warning at the login screen.

 

If I revert it to the original and carry out the rest of the changes then there is no change - the items in the cart are lost when going over to the SSL pages.

[Jack_mcs]

Try this instead

define('HTTP_COOKIE_DOMAIN', '/');
define('HTTPS_COOKIE_DOMAIN', '/');

Did you check the other setting I mentioned?

[burt]

Shared SSL is always problematic.  

 

In my opinion, shared SSL is less professional than no SSL - changing from .site.com to .some-host-shared-ssl.com/~username/ is highly unprofessional for any ecomm.

 

I would set up the site with no SSL.  

And then add a full SSL Cert at a future date.

[Mort-lemur]

@@Jack_mcs Yep - I have spent hours messing around with the settings

 

@@burt Yes Im now in agreement - I didnt like the way the URL looked, so have reverted to non-ssl for now

[Jack_mcs]

Setting up shared ssl's can be difficult but they are far more preferable, in my opinion, than running a shop without one. Most surfers just know to look for the padlock or https and don't care much about what the url says. If you are planning on getting a private ssl fairly soon, then it is probably not a concern. But running that way for long will probably cost you in lost sales. I don't know about you but I won't use a site that doesn't have ssl.

[Guest]

@@Mort-lemur

 

Hi

 

I also used to have that problem, so purchased a SSL cert. For 2 years I think the cost was about US$12.00 I think I may sitll have the link, so could PM you if you wish.

 

Cheers

 

Grandpa

[burt]

If cost is the issue, wait for this bunch to make it easier for Joe-Public-SiteOwner to set up a Free Cert; 

 

https://letsencrypt.org/