HTTPS

 1、HTTPS (Hyper Text Transfer Protocol Secure) is a secure version of the Hyper Text Transfer Protocol

(http).Https is not a separate protocol, but refers to the combination of a normal HTTP interaction over

an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection.

2、When a SSL - Digital Certificate is installed on a web site, a padlock icon can be seen at the bottom

area of the navigator and also the address in the address bar will begin with "https" instead of http

during a secure ecommerce transaction, which means that the data is encrypted.

3、SSL uses a cryptographic system that uses two keys to encrypt data, first a public key known to

everyone and the second is the private key known only to the recipient. SSL an unique and effective way to

achieve data and ecommerce security.

4、HTTP data is sent over TCP/IP port 80, whereas SSL HTTP data is sent over port 443.

5、How to redirect http to https  
question：using jboss-4.0.2 with tomcat, I am able to configure ssl and my web app works well if user

points to https://myhost:8443/mycontext,
But how can I redirect http://myhost/mycontext to https://myhost:8443/mycontext .i.e make sure that http

request is redirected to https
answer：Add this snippet to the 'web.xml' file of the Tomcat. I think this should work.

<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Context</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<!-- auth-constraint goes here if you requre authentication -->
<user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

6、（1）How to redirect the browser to https when site is using http protocal in PHP?

First of all, you should know that SSL must be installed in the server. To redirect the browser to “https

” , we must know that the site is using SSL or not at the moment. And for this, there is a server

variable in PHP called “HTTPS”. $_SERVER['HTTPS'] returns “on” values when the site is using SSL

connection.

Function to redirect the browser to “https” in PHP：
function redirectToHTTPS()
{
  if($_SERVER['HTTPS']!=”on”)
  {
     $redirect= “https://”.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
     header(”Location:$redirect”);
  }
}
Above function is quite simple, you can call the function in that page where you’ve to redirect the

browser to “https” .This function will preserver you script file name and query string in browser.

     （2）Redirecting whole website to “https” using .htaccess

You can call the above function in each and every page to redirect the browser to “https”. But rather

than doing so it will be better to write three line of code in .htaccess file to redirect the whole

website to use SSL connection throughout the pages.

  RewriteEngine On
  RewriteCond %{HTTPS} !on
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Just copy and paste the above code in .htaccess file then the whole website will be redirected to “https

” when the browser is opened in “http” mode. The browser just get redirected using url rewriting in

.htaccess.

7、How to I configure SSL for secure https transactions?
What is SSL?
CubeCart can run under a combination of http and https which allows you to send sensitive data such as

credit card numbers and other private information between the client computer and server.

To setup your store to use SSL (Secure Socket Layer) you will first need an SSL certificate. Many hosting

companies will either provide (or can offer) "Shared SSL" or the option to buy a "Dedicated SSL"

certificate.

Shared SSL means that your store will run using two domains your master domain name and shared secure

domain which may be used by other customers of your hosting company.
Dedicated SSL means that you will have your own SSL certificate which enable you to run your store on one

domain using http and https.

e.g.
Shared SSL:
Master Domain: http://www.example.com
Shared Secure Domain: https://secureexample.com/username

Dedicated SSL:
Master Domain: http://www.example.com
Secure Domain: https://www.example.com

Most people prefer to use dedicated SSL as it looks more professional and can improve customer confidence.

How do I test SSL is working?
Before we do anything we need to test that the SSL domain has been configured correctly.

In this example we will assume your webstore is located at http://www.example.com/store


If you have dedicated SSL simply go to your master doman and store directory using your browser.

http://www.example.com/store

You should now be presented with your CubeCart store. If not, you have either typed the wrong URL or your

it has not been installed properly.

To test if you dedicated SSL certificate is working change the protocol in the address bar from http to

https.

https://www.example.com/store and press return.

If it has been installed correctly the store should reload and a padlock will appear in the status bar of

your browser software. If, on the other hand you get any warning messages or other errors please contact

your hosting company to resolve the issue.

If you have shared SSL your hosting company should have given you your secure URL which in most cases will

be a domain with folder allocated to you.

e.g. https://secureexample.com/username

By going to the address given by your hosting company it should take you to the main index page of your

website. If this is the case and you see a padlock on the status bar of your browser it should be setup

ok. Again, if you have any error messages or warnings please conatct your hosting company. To check

CubeCart under SSL you will need to go to the install location. In our example this would be:

https://secureexample.com/username/store


How do I configure CubeCart to operate under SSL?
Now we know SSL is working we can set CubeCart to run in SSL mode. As SSL is very server intensive only

parts of your store will run using it. These include payment pages, administration and registration etc...

Log into the admin side of your store.

e.g. http://www.example.com/store/admin

Once in click the "General Settings" link under the Store Config Section and scroll down to the

Directories & Folders section. Here you will be presented with some text boxes and a drop down menu to

enable SSL mode.

1. Root SECURE Public HTML Folder to store: (Include Trailing Slash)
This is the server folder path from the end of your secure domain name.

e.g.
Shared SSL: /username/store/
Dedicated SSL: /store/

2. Absolute SECURE URL to store: (Excluding Trailing Slash)
This is the full address you woudl type in the browser to access your store under SSL.

e.g.
Shared: https://secureexample.com/username/store
Dedicated: https://www.example.com/store

Double check all the values entered and once happy use the drop down menu to enable SSL. Then scroll to

the bottom of the page and click the "Update Settings" button.

If you have entered the information correctly you store should now be functioning with secure

transactions. Sometimes users enter the information wrong or there is some other problem. If this is the

case please have a look at the folowing article: http://www.cubecart.com/site/helpdesk/index.php?

_m=knowledgebase&_a=viewarticle&kbarticleid=20&nav=0,2