6

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data).

The website is hosted on a shared platform, and I've bought unique IP + Comodo SSL certificate at my webhost, they will take care of the installation.

Next monday the website will be tested by an audit company, so I need to be sure everything is perfectly secured. The web application itself and the server are perfectly secured conforming the requirements (done by a collegue with decent skills) - it's just the SSL that still needs to be installed.

My questions:

  • Does this require extra configuration in the website source code?
  • Does this mean the website can not be reached over http, and only over https? My webhost told me I could see the https as an extra feature, and regular http will also remain available. So how can I be sure that all traffic goes over https?

(Sorry for my noob questions - I'm a designer, not a server specialist - and I have absolutely no experience with SSL..)

Thanks!

Improve this question
1

2 Answers 2

Reset to default
5

No, no extra configuration is required in the website source code. The HTTPS is handled by the webserver and should be largely transparent to your website codebase. You should though make sure no internal links are hardcoded starting with "http" as they will then (possibly) take the user out of the encrypted transaction. Even if it doesn't those links will possibly raise a security warning if they are for embedded images etc.

It is possible to allow both HTTP and HTTPS access at the same time to the same site. This is a webserver configuration issue and only matters for the website code in that you need to consider the form of absolute links as mentioned above. It is common for sites to have a part of it using HTTP and then require HTTPS for other pars (e.g. log in etc.).

In summary, this is almost entirely a server configuration issue and you shouldn't need to worry about it aside from relative links.

Improve this answer
2
  • thanks for the detailed answer, no hardcoded http-links - so i guess there's nothing to worry about anymore...
    – ptriek
    Dec 9, 2011 at 13:12
  • sorry to bother you again, but you're my best shot: the certificate has been installed, but it's not working. My webhost tells me that 'my application probably doesn't support SSL', and has asked me to set an SSL variable to true in my php code - can you point me in the right direction, i don't have a clue (and google doesn't help me either)...
    – ptriek
    Dec 9, 2011 at 17:45
0

/etc/rc.d/init.d/iptables

in this add you this line

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

Improve this answer
2
  • 1
    It's generally not ideal to throw a giant string of code/config at people without any explanation. Do you mind expanding on this, or providing a reference link so they at least know what the result is going to be? (eg. many users aren't even going to have the access to make this edit)
    – Su'
    Apr 27, 2012 at 18:54
  • There's not enough information to determine that the firewall is the problem. It's likely that his host provider already have port 443 open when they installed the certificate. There's no indication he's running a RedHat-based distro, or even Linux. It's likely he has no SSH access to the box, I think he might have even stated this in another question.
    – Ladadadada
    Jun 2, 2012 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.