SSL setup

[Craig]

Is there a method of procedure for setting a site up to SSL available?

[Mark.B]

It's fairly straightforward:

1. Install SSL certificate on server
2. Update the three URL settings in the admincp to reflect https
3 Redirect http to https at server side.

[Craig]

Thank you, Mark!

[jdj]

It's fairly straightforward:

1. Install SSL certificate on server
2. Update the three URL settings in the admincp to reflect https
3 Redirect http to https at server side.

Should it be all three? I'm trying to set this up at the moment and in admincp, settings, options, site name/URL/Contact Details the only one that's specified as for SSL is the one saying Login URL. What happens if you don't change all three but just change the Login URL?

[glennrocksvb]

You can but it's recommended to make the entire site as https if you have SSL. Google prefers secure sites more. And soon Chrome will put a scary warning at the address bar for non-https sites.

[jdj]

It's fairly straightforward:

1. Install SSL certificate on server
2. Update the three URL settings in the admincp to reflect https
3 Redirect http to https at server side.

I have all three URL settings in the admincp reflecting https.

How do I 'Redirect http to https at server side'. Do I do this via .htaccess and if so, what do I put in the file.

[jdj]

It's fairly straightforward:

1. Install SSL certificate on server
2. Update the three URL settings in the admincp to reflect https
3 Redirect http to https at server side.

I never got an answer to this. What code do I put in the .htaccess file to redirect http to https?

Is it:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^mysite\.com [NC]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.mysite.com/$1 [R,L]

Or something else?

[Wayne Luke]

I have all three URL settings in the admincp reflecting https.

How do I 'Redirect http to https at server side'. Do I do this via .htaccess and if so, what do I put in the file.

Add this code directly under the RewriteBase line in your .htaccess file.

    #To redirect users to the secure version of your site, uncomment the lines below
    RewriteCond %{HTTPS} !=on
    RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

[jdj]

Add this code directly under the RewriteBase line in your .htaccess file.

#To redirect users to the secure version of your site, uncomment the lines below
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

I did this. What I found was that the site is still accessible from http so it didn't appear to work. What it did do was to inactivate the login feature. If I go to login now I get the error message:

NOT FOUND

The requested URL/auth/login-form was not found on this server.

Apache server at mysite.com Port 443

So what code should I use in the .htaccess file? The reason I need to know is that having switched https on and changed all three URLs in the admincp to https, if I go to my site via http://mysite.com it doesn't let me login and presumably doesn't let anybody else login. It only lets me login if I go directly to https://mysite.com. So I do need to redirect.


To be clear: The first 12 lines of my modified .htaccess file read exactly as follows:


<IfModule mod_rewrite.c>
RewriteEngine On

# In some cases where you have other mod_rewrite rules, you may need to remove the
# comment on the following RewriteBase line and change it to match your folder name.
# This resets the other mod_rewrite rules for just this directory
# If your site was www.example.com/forum, the setting would be /forum/
#RewriteBase /

#To redirect users to the secure version of your site, uncomment the lines below
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

---------

Reversing the changes also allows me to login to the site from the front end from https if I navigate there directly then. So it's this code that's causing the problem.

Specifically what code should I use?

[Wayne Luke]

It should redirect everything to HTTPS. If you're getting 404 errors, you need to discuss this with your hosting provider as this is a server directive. We are only providing it as a courtesy. They may need different directives based on their server configurations.

[Mark.B]

If it helps, I use this and it works fine:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

[jdj]

If it helps, I use this and it works fine:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

That gave me a tab saying 302 found and a white page saying
Found

The document has moved here.

---

Apache Server at [mysite.com] Port 80

[jdj]

My host suggested this:

QUOTE:

Based on a search, to force all web traffic to use HTTPS, you should be able to use the below in your htaccess file

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

To force traffic for a specific domain to use HTTPS, you would use

RewriteEngine On
RewriteCond %{HTTP_HOST} ^example\.com [NC] RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

With regards to the 404 errors you are seeing, this may be a result of the order of the rewrite rules - they are called in the order in which they appear in the htaccess, so you may need rearrange the existing rewrite rules you have set up to get it to work as intended.

END QUOTE:

The 2nd suggestion didn't seem to do anything at all. The first does seem to redirect all traffic to https but we have an EV SSL. When I view the site in Firefox I see the EV SSL, when I view it in IE I don't. So given that this partly works, what would I have to do to get IE to show the EV SSL as well?

[Wayne Luke]

What is an EV SSL?

[jdj]

What is an EV SSL?

Extended Validation SSL - it shows a green bar in the browser with the name of the company in whose name the domain is registered for extra security.

Example here.

https://bank.barclays.co.uk/olb/auth/LoginLink.action

[Mark.B]

Extended Validation SSL - it shows a green bar in the browser with the name of the company in whose name the domain is registered for extra security.

Example here.

https://bank.barclays.co.uk/olb/auth/LoginLink.action

This isn't something we've tested or investigated. Can't see any reason why it wouldn't work though.