How To use OSCommerce with SSL

SSL for OSCommerce 2.2 Milestone 2

This is a simple guide created by a customer of WHB who learned the hard way.
Please use this as an overview rather than a “hard and fast” idiot proof guide.

Get a Fixed IP address for your web site.
Read http://www.whbsupport.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=128

http://www.webhostingbuzz.com/ordernewIPaddress.htm

SSL sees www.yourdomain.com and yourdomain.com as separate websites.
For oscommerce:
in catalogue/include/configure.php
(lines 14,15,17,18) from yourdomain.com to www.yourdomain.com

And
In catalogue/admin/include/configure.php
(lines 14,15,16) from yourdomain.com to www.yourdomain.com

Then contact an SSL certificate supplier
http://ev1servers.net is recommended by WHB and look http://www.ev1servers.net/hosting/domains/index.asp for details (this link may change)
- Don’t buy anything yet.

Once chosen you’re ready to go ahead you’ll need to setup a WHB ticket so the WHB support can issue a CSR. Please note if you are in the UK the two digit country code is GB.
A handy link is:
http://www.digicert.com/csr-creation.htm
and
http://www.digicert.com/ssl-certificate-country-codes.htm

You'll get a CSR from WHB support that looks like:

-----BEGIN CERTIFICATE REQUEST-----
MIICFTCCAX4CAQAwgZ8xCzAJBgNVBAYTAlVLMQ0wCwYDVQQIEwRGaWZlMRQwEYD
9w0BCQEWFmdyYW50QG1hcnktc3Rld2FydC5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD
gY7AMIGJAoGBALPtrluPZjWhRr3x54x/l9hLqPQZjWKZH+HNZaoksukUUWm3xcl
f6diJnQeD7pxtSoldcTbq7lQvhxGpi72MzLxFa+jPZRplJTiadYDnxuAo0lyy5t
iEeeevhzk3hVqosXtnf6XlebnqVpSXV7RbFjz/eykQ56o0H/jAUHM+jdAgMBAAGg
NTAWBgkqhkiG9w0BCQcxCRMHc3AxZGVyMTAbBgkqhkiG9w0BCQIxDhMMTWFyeSBT
dGV4YXJ0MA0GCSqGSIb3DQEBBAUAA4GBAEmrgCBXIe5GiusyVTjg7Exu4A+A1nxU
7eugoo12JWYd/92S5mQza+JpJyW7T5POXLYtowmc3lKMbDhV2Kzi4pTEMaoFho
oAgRQV5DIxB/ZStzcHkHpd9LGfvfdM8JSs7vwTL63FayRxMlZAQWxklj2tmbV2Qw
ZqIS7LsvwP6
-----END CERTIFICATE REQUEST-----

Ensure and test that your admin@yourdomain.com does not go into a black hole. You will need it to verify your ssl. Test it before you buy the ssl.

Have a phone free nearby prior to starting. Geotrust call you to verify the SSL.
You are now ready to order the ssl.

In the order process you will
- enter the web name – check that it is www.yourdomain.com – take your time double check spelling and that it is not just yourdomain.com it must match your oscommerce or you will have endless problems.
- copy the entire CSR including
- -----BEGIN CERTIFICATE REQUEST-----
- all the text from WHB support email
- -----END CERTIFICATE REQUEST----
- and paste it into the requested box.
- select admin@yourdomain.com as your email that geotrust send confirmation
- You’ll get an email within seconds with a link and pin number.
- Follow the link You need to give a phone number with country code
- Sure enough the phone rings and you follow the instructions.
- Then you are verified.

Not quite done yet.
- Check you mail again and you now have an email asking you to follow a link from geotrust.
- This creates the certificate to give back to the WHB support team.
It looks like:

Your Web Server Certificate:

-----BEGIN CERTIFICATE-----
MRwxxVQQKExNFcXVpZmF4IFNlY3VZSBJbmMuMS0wKwYDVQQDEyRFcXVpZmF4
IFNlY3VyZSBHbG9iYWwgZUJ1c2luZXzIENBLTEwHhcNMDUxMjEyMjAwMzQzWhcN
MDYxMjEzMjAwMzQzWjCB7TELMAkGA1EBhMCR0IxHTAbBgNVBAoTFHd3Ty5tYXJ5
LXN0ZXdhcnQuY29tMTwwOgYDVQQLEzNodHRwczovL3NlcnZpY2VzLmNob2ljZXBv
aW50Lm5ldC9nZXQuanNwP0dUNTQ5Ng4MjYxMTAvBgNVBAsTKFNlZSB3d3cuZ2Vv
dHJ1c3QuY29tL3Jlc291cmNlcy9jcHMgKGMpMDUxLzAtBgNVBAsTJkRvbWFpbiBD
b250cm9sIFZhbGlkYXRlZCAtIFF1aWNrUNMKFIpMR0wGwYDVQQDExR3d3cubWFy
eS1zdYV3YXJ0LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArKZXELsf
Qjm2IG5WzS8QE3+m5rNOtnzvX/E0yDxFckJXG0Az2z2cp20zZA6t8J8rhomXM+Z
BtcE1sGzVzBLfOaQJiyLjEt9MHhhd+R4V9uO65dTyq0UglccL7hH/O4L5KRk9rf
JyJzz7nvYAIzrNuu+OUPMFGx/5vZg0iLOk8CAwEAAaOBvTCBujAOBgNVHQ8BAf8E
BAMCBPAwQYDVR0OBBYEFF2Zb/7yTffCIVvkoorJeReDUxBMDsGA1UdHwQ0MDIw
MKAutCyGKmh0dHA6Ly9jcmwu2VvdHJ1c3QuY29tL2NybHMvZ2xvYmFsY2ExLmNy
BsEFBQcDAQYIKwYBBQUHAwIwAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOB
gQBWUtAjNYQgGzvJAUnUnNU9QFP0tbzNuj/QtcNEZ+JLXQhCurybMTEmCzI3rMDL
EzrZII3CKh0mLcsh39dLLFNstQXiNz+/AvtKN2vSK5giGMUVlZwhZMpMw5uBbEzr
lzDkk7UizAha+tRWt7XT43KBnbSUe4ahReuz6QrHYhETA==
-----END CERTIFICATE-----
Copy and paste it all into the ticket and post.

WHB support then update the software on the server and it’s done.

In Os commerce change
in catalogue/include/configure.php
Line 16 to true (set SSL to true)
And
In catalogue/admin/include/configure.php
Line 17 to true (set SSL to true)

To check that it is working simply purchase something from your shop and click new customer, as soon as you change page to enter your personal details the “golden lock” should appear.

Also try https://www.yourdomain.com the “golden lock” should appear.