• We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors with cookies with encrypted passwords)

  • On a previous security audit by an external company several security issues have been found. All these issues have been solved by a collleague PHP developer.

  • However, one last requirement has been added - all data should be transfered over https.

  • My php collegue is on holiday, however - and unavailable at the moment. So I contacted my host, and asked for installing SSL certificate. I myself have no knowledge/experience with SSL, so I'm a bit at loss for the following problems.

  • Comodo SSL certificate + unique IP address has been installed today by my webhost for subdomain axa.tfo.be (by www.combell.be).

  • However, it doesn't seem to be working. I posted a question about this earlier today, and was told not to worry, see link: What happens if you install an SSL certificate?

  • Current problems:

  • My webhost is telling me that 'my application probably doesn't support SSL', and has asked me to set an SSL variable to true in my php code.

So my questions:

  • I have basic knowledge of php, but don't know where to start regarding the 'php ssl variable'. The sites have been online for some time, and have been developed for regular php access. (Google didn't bring me any help, either.)
  • Can anyone point me in the right direction, or give me some clues about whether/what I should ask my webhost for further assistance?
  • (I'm a bit on a tight schedule, the sites will be audited again on monday, and it's a customer i wouldn't want to loose...)

Thanks for looking into this, and sorry if my questions sound a bit nooby - I'm a webdesigner, not a server specialist...

  • This has more to do with the web server serving SSL connection than it does with PHP , IMHO.
    – djangofan
    Dec 9, 2011 at 23:19
  • so what do you recommend me to reply to the host support?
    – ptriek
    Dec 9, 2011 at 23:20

2 Answers 2


Whether or not your connection to the HTTP server is over SSL is irrelevant to the PHP (unless you, for instance, put something in the PHP to verify the connection is over SSL, and redirect to https:// if it's not). Application support within the PHP has no bearing on whether an SSL connection can be made between your server and a client browser.

Simply, your provider is blowing smoke; their response sounds like they haven't set up the web server to allow SSL connections correctly.

Or, is your DNS for the domain name still pointing to the non-dedicated IP address (on which the SSL listener probably isn't configured)?

  • Alternately, the app COULD be looking for hardcoded http links, in which case he's nuked. Dec 9, 2011 at 23:17
  • i thoroughly checked the code today, i can confirm there is no SSL check whatsoever in the code. Still seems strange to me - as far as I know it's a pretty well-known/reliable hosting firm - at least i never had any trouble with them before (and there services don't come cheap :-)
    – ptriek
    Dec 9, 2011 at 23:19
  • Yeah - the static content not working either is a good indicator that the SSL listener isn't working on the server's current address. What error does your browser report when attempting to access the pages over SSL? Dec 9, 2011 at 23:20
  • it just gives me a 404 not found
    – ptriek
    Dec 9, 2011 at 23:23
  • @ptriek Interesting... ask them if they set a different document root for SSL than the non-SSL site? Dec 9, 2011 at 23:24

The site https://axa.tfo.be/incentives/cipres/static.html is presenting a self-signed SSL certificate. The IT department for AXA (specifically, whoever owns the axa.tfo.be domain) needs to obtain a valid certificate to use with the web server.

Once the SSL certificate is properly installed, you will need to set up some sort of redirection so that URLs that are required to be HTTPS will be, if they're accessed via plain HTTP. This can be done in the web server configuration or in the PHP. The web server configuration method will be better performing, while redirects from PHP may be more flexible from the application programming side, if the people in charge of the web servers are uncooperative.

  • I am the owner of axa.tfo.be, and I bought Comodo certificate for this subdomain yesterday, installed by my webhost www.combell.be today (just now). (IT department of AXA has nothing to do with it, it's an externally hosted website, not within legal authority of AXA itself). All http traffic (now and in the future) should be indeed redirected to https, and I'd prefer this to be done server side (instead of php), so you'd also recommend to contact my host for this?
    – ptriek
    Dec 9, 2011 at 23:40
  • You need to talk to whoever can configure the web server. Right now, the web server is presenting a self-signed cert rather than the one you bought. So, as a first step, the web server should be configured to use your certificate. The second step, if everything is supposed to be SSL, you will need to configure the web server to redirect everything coming into the HTTP to the equivalent URI on the HTTPS server. How this is done depends on the web server software, etc.
    – cjc
    Dec 9, 2011 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .