Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
  • We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors with cookies with encrypted passwords)

  • On a previous security audit by an external company several security issues have been found. All these issues have been solved by a collleague PHP developer.

  • However, one last requirement has been added - all data should be transfered over https.

  • My php collegue is on holiday, however - and unavailable at the moment. So I contacted my host, and asked for installing SSL certificate. I myself have no knowledge/experience with SSL, so I'm a bit at loss for the following problems.

  • Comodo SSL certificate + unique IP address has been installed today by my webhost for subdomain axa.tfo.be (by www.combell.be).

  • However, it doesn't seem to be working. I posted a question about this earlier today, and was told not to worry, see link: What happens if you install an SSL certificate?

  • Current problems:

  • My webhost is telling me that 'my application probably doesn't support SSL', and has asked me to set an SSL variable to true in my php code.

So my questions:

  • I have basic knowledge of php, but don't know where to start regarding the 'php ssl variable'. The sites have been online for some time, and have been developed for regular php access. (Google didn't bring me any help, either.)
  • Can anyone point me in the right direction, or give me some clues about whether/what I should ask my webhost for further assistance?
  • (I'm a bit on a tight schedule, the sites will be audited again on monday, and it's a customer i wouldn't want to loose...)

Thanks for looking into this, and sorry if my questions sound a bit nooby - I'm a webdesigner, not a server specialist...

share|improve this question
    
This has more to do with the web server serving SSL connection than it does with PHP , IMHO. –  djangofan Dec 9 '11 at 23:19
    
so what do you recommend me to reply to the host support? –  ptriek Dec 9 '11 at 23:20

2 Answers 2

Whether or not your connection to the HTTP server is over SSL is irrelevant to the PHP (unless you, for instance, put something in the PHP to verify the connection is over SSL, and redirect to https:// if it's not). Application support within the PHP has no bearing on whether an SSL connection can be made between your server and a client browser.

Simply, your provider is blowing smoke; their response sounds like they haven't set up the web server to allow SSL connections correctly.

Or, is your DNS for the domain name still pointing to the non-dedicated IP address (on which the SSL listener probably isn't configured)?

share|improve this answer
    
Alternately, the app COULD be looking for hardcoded http links, in which case he's nuked. –  Driftpeasant Dec 9 '11 at 23:17
    
i thoroughly checked the code today, i can confirm there is no SSL check whatsoever in the code. Still seems strange to me - as far as I know it's a pretty well-known/reliable hosting firm - at least i never had any trouble with them before (and there services don't come cheap :-) –  ptriek Dec 9 '11 at 23:19
    
Yeah - the static content not working either is a good indicator that the SSL listener isn't working on the server's current address. What error does your browser report when attempting to access the pages over SSL? –  Shane Madden Dec 9 '11 at 23:20
    
it just gives me a 404 not found –  ptriek Dec 9 '11 at 23:23
    
@ptriek Interesting... ask them if they set a different document root for SSL than the non-SSL site? –  Shane Madden Dec 9 '11 at 23:24

The site https://axa.tfo.be/incentives/cipres/static.html is presenting a self-signed SSL certificate. The IT department for AXA (specifically, whoever owns the axa.tfo.be domain) needs to obtain a valid certificate to use with the web server.

Once the SSL certificate is properly installed, you will need to set up some sort of redirection so that URLs that are required to be HTTPS will be, if they're accessed via plain HTTP. This can be done in the web server configuration or in the PHP. The web server configuration method will be better performing, while redirects from PHP may be more flexible from the application programming side, if the people in charge of the web servers are uncooperative.

share|improve this answer
    
I am the owner of axa.tfo.be, and I bought Comodo certificate for this subdomain yesterday, installed by my webhost www.combell.be today (just now). (IT department of AXA has nothing to do with it, it's an externally hosted website, not within legal authority of AXA itself). All http traffic (now and in the future) should be indeed redirected to https, and I'd prefer this to be done server side (instead of php), so you'd also recommend to contact my host for this? –  ptriek Dec 9 '11 at 23:40
    
You need to talk to whoever can configure the web server. Right now, the web server is presenting a self-signed cert rather than the one you bought. So, as a first step, the web server should be configured to use your certificate. The second step, if everything is supposed to be SSL, you will need to configure the web server to redirect everything coming into the HTTP to the equivalent URI on the HTTPS server. How this is done depends on the web server software, etc. –  cjc Dec 9 '11 at 23:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.