Protect using SSL

RPS · #1 01-25-08, 09:54 PM

With the current way WHMCS handles SSL, your clients can log in on pages that are not via SSL. There are also other areas that WHMCS forces to use http instead of https (I believe the announcements and knowledgebase are both without https).

You can use .htaccess to force everything to happen via https, however, file downloads will NOT work if this is the case.

When you try to download a file using rewrite rules that forces your URL to be https, IE has an issue with downloading files (in this case, the downloads page).

Open 'Configuration' -> 'General Configuration'
Set WHMCS System URL to https://www.domain.com/whmcs/ (note the s within https)
Set WHMCS SSL System URL to empty

The follow code (which you should place inside your .htaccess file), will force all requests to the WHMCS folder to be done via https, unless it is the whmcs/dl.php file.

The code after, will force the whmcs/dl.php to redirect from https to http.

Code:

RewriteEngine on
Options +FollowSymlinks

#Rewrite the URL for WHMCS to always use https except for the whmcs/dl.php file
RewriteCond %{REQUEST_URI} !^/whmcs/dl.php [NC]
RewriteCond %{REQUEST_URI} ^/whmcs/ [NC]
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://www.domain.com/$1 [R=301,L]

#Rewrite the URL for WHMCS dl area to always use http
RewriteCond %{REQUEST_URI} ^/whmcs/dl.php [NC]
RewriteCond %{SERVER_PORT} !^80$
RewriteRule ^(.*)$ http://www.domain.com/$1 [R=301,L]

ruskyhost · #2 01-26-08, 01:57 PM

This worked great!, thanks.

Dave.

idweb · #3 02-03-08, 08:05 PM

Agree with ruskyhost, this worked great. Was getting certificate error before I tried this now no problems. Thanks !!

rosend511 · #4 02-11-08, 04:31 AM

This is not working for me. I did the config thing, edited the .htaccess and nothing. Someone help please...

RPS · #5 02-11-08, 05:49 AM

What do you mean by "not working"

When you bring your car into the mechanic shop, do you simply tell the mechanic that your car "isn't working" ?

rosend511 · #6 02-11-08, 10:40 AM

http://www.cod4gs.com/my/

Go try to order something with Google Checkout. You will see what I mean. I think the problem is that I have an old certificate on there, but I did not know how to check and take it off.

Help....

RPS · #7 02-11-08, 03:59 PM

Your SSL cert is for dindarahosting.com, not cod4gs... You need to contact your host to fix this.

rosend511 · #8 02-11-08, 10:03 PM

they dont know how.

RPS · #9 02-11-08, 10:05 PM

Quote:

Originally Posted by rosend511

they dont know how.

- Find a new host then

It's like asking your auto mechanic to replace your tire, and the guy looks at you and says "I don't know how to replace a tire"

rosend511 · #10 02-11-08, 11:48 PM

well im my own host, so how do i do it. i have full access cpanel.

RPS · #11 02-12-08, 01:45 AM

Quote:

Originally Posted by rosend511

well im my own host, so how do i do it. i have full access cpanel.

- Ask in cPanel forums or WHT, not here in WHMCS. It's a hosting problem. Honestly though, if you don't know how to manage your server, you need to hire a server admin.