Difference between revisions of "X-Cart:Configuring HTTPS"
m |
m |
||
| Line 23: | Line 23: | ||
If you are using a web server of the above-named type, to set your entire X-Cart store to operate over HTTPS, you should add the following code to the .htaccess file after the line "RewriteBase": | If you are using a web server of the above-named type, to set your entire X-Cart store to operate over HTTPS, you should add the following code to the .htaccess file after the line "RewriteBase": | ||
| − | < | + | <nowiki> |
RewriteCond %{HTTPS} off | RewriteCond %{HTTPS} off | ||
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] | RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] | ||
| − | </ | + | </nowiki> |
If the canonical URL of your site is known, it will be even better to add the rules as follows: | If the canonical URL of your site is known, it will be even better to add the rules as follows: | ||
| − | < | + | <nowiki> |
RewriteCond %{HTTPS} off | RewriteCond %{HTTPS} off | ||
RewriteRule ^(.*)$ https://example.com/$1 [^] [R=301,L] | RewriteRule ^(.*)$ https://example.com/$1 [^] [R=301,L] | ||
| − | </ | + | </nowiki> |
(Be sure to replace "example.com" with your actual canonical URL). | (Be sure to replace "example.com" with your actual canonical URL). | ||
The above code should be added before the code for handling Clean URLs. | The above code should be added before the code for handling Clean URLs. | ||
| Line 44: | Line 44: | ||
to nginx.conf | to nginx.conf | ||
as follows: | as follows: | ||
| − | < | + | <nowiki> |
server { | server { | ||
listen 80 default_server; | listen 80 default_server; | ||
| Line 51: | Line 51: | ||
return 301 https://$host$request_uri; | return 301 https://$host$request_uri; | ||
} | } | ||
| − | </ | + | </nowiki> |
For more info, see: | For more info, see: | ||
https://www.bjornjohansen.no/redirect-to-https-with-nginx | https://www.bjornjohansen.no/redirect-to-https-with-nginx | ||
| Line 64: | Line 64: | ||
X-Cart versions prior to 4.7.9:<br /> | X-Cart versions prior to 4.7.9:<br /> | ||
To switch your entire X-Cart store to secure mode, edit the file https.php. Find the line: | To switch your entire X-Cart store to secure mode, edit the file https.php. Find the line: | ||
| − | < | + | <nowiki> |
function is_https_link($link, $https_scripts) { | function is_https_link($link, $https_scripts) { | ||
| − | </ | + | </nowiki> |
and replace it with | and replace it with | ||
| − | < | + | <nowiki> |
function is_https_link($link, $https_scripts) { | function is_https_link($link, $https_scripts) { | ||
return true; | return true; | ||
| − | </ | + | </nowiki> |
===Enable HTTPS for the login, registration, checkout and payment pages=== | ===Enable HTTPS for the login, registration, checkout and payment pages=== | ||
| Line 82: | Line 82: | ||
If you do not wish to enable HTTPS for the entire store site but just need to secure some php scripts in your X-Cart store so they can only be accessed via HTTPS, you should add the scripts that need to be secured to the 'https_scripts' array in the file <xcart_dir>/https.php. You can find some examples of how that can be done right in the file <xcart_dir>/https.php: | If you do not wish to enable HTTPS for the entire store site but just need to secure some php scripts in your X-Cart store so they can only be accessed via HTTPS, you should add the scripts that need to be secured to the 'https_scripts' array in the file <xcart_dir>/https.php. You can find some examples of how that can be done right in the file <xcart_dir>/https.php: | ||
| − | < | + | <nowiki> |
$https_scripts[] = 'login.php'; | $https_scripts[] = 'login.php'; | ||
$https_scripts[] = array( | $https_scripts[] = array( | ||
| Line 88: | Line 88: | ||
"mode=checkout", | "mode=checkout", | ||
); | ); | ||
| − | </ | + | </nowiki> |
==HTTPS Proxy== | ==HTTPS Proxy== | ||
Now, if your web server does not use SSL certificates, and you are running an HTTPS Proxy instead, you may need to make additional settings to enable your X-Cart work over SSL (secure connection). In the include/https_detect.php file, define the proxy IP address and set the $HTTPS variable to 'true': | Now, if your web server does not use SSL certificates, and you are running an HTTPS Proxy instead, you may need to make additional settings to enable your X-Cart work over SSL (secure connection). In the include/https_detect.php file, define the proxy IP address and set the $HTTPS variable to 'true': | ||
| − | < | + | <nowiki> |
if ($_SERVER['REMOTE_ADDR'] == '192.160.1.1') { | if ($_SERVER['REMOTE_ADDR'] == '192.160.1.1') { | ||
$HTTPS_RELAY = true; | $HTTPS_RELAY = true; | ||
$HTTPS = true; | $HTTPS = true; | ||
} | } | ||
| − | </ | + | </nowiki> |
If you are not sure whether your web server uses SSL certificates or runs behind an HTTPS Proxy, contact your hosting service provider or server administrator or email our technical support - we will help you find that out. | If you are not sure whether your web server uses SSL certificates or runs behind an HTTPS Proxy, contact your hosting service provider or server administrator or email our technical support - we will help you find that out. | ||
| Line 104: | Line 104: | ||
If you experience problems with external services (payment / shipping) working over https while using curl/libcurl as the https module, try adding the following line to <u>top.inc.php</u>: | If you experience problems with external services (payment / shipping) working over https while using curl/libcurl as the https module, try adding the following line to <u>top.inc.php</u>: | ||
| − | < | + | <nowiki> |
define('USE_CURLOPT_SSL_VERIFYPEER', 1); | define('USE_CURLOPT_SSL_VERIFYPEER', 1); | ||
| − | </ | + | </nowiki> |
after | after | ||
| − | < | + | <nowiki> |
| + | $xcart_dir = rtrim(realpath($xcart_dir), XC_DS); | ||
| + | </nowiki> | ||
<br /><br /> | <br /><br /> | ||
[[Category:X-Cart user manual]] | [[Category:X-Cart user manual]] | ||
Revision as of 15:53, 15 November 2017
This article provides guidelines for configuring HTTPS for your X-Cart store.
Contents
Obtain an SSL certificate
To use HTTPS for your X-Cart store site, you need to obtain an SSL certificate and have it properly installed and configured on your web server. You also need to monitor your SSL certificate expiration date and be ready to renew it when necessary.
The majority of hosting companies help their customers to purchase SSL certificates or provide their own Shared SSL URLs. If your hosting company does not render such services, you will need to purchase a certificate on your own.
We will be glad to assist you with this issue. You can purchase SSL certificates from our company. We sell SSL certificates provided by the world's leading Certification Authority, Comodo Group. For details, conditions and prices, please see http://www.x-cart.com/ssl/.
If you are on a dedicated server, we can offer you our service on analyzing and configuring your server and/or install an SSL Certificate on it. Please note that we will need the 'root' access to your server over SSH or the 'Administrator' access over MS Remote Access Desktop to complete these tasks.
Configure the HTTPS server in X-Cart
Once you have an SSL certificate for your store site installed and configured, you should adjust the HTTPS server settings in X-Cart. If your HTTPS host differs from your HTTP host, you will need to edit the file <xcart_dir>/config.php specifying your HTTPS host in the variable $xcart_https_host.
Enable HTTPS for your store
Enable HTTPS for the entire X-Cart store site
Method 1. HTTPS for the entire store - Web servers with support for .htaccess, like apache
If you are using a web server of the above-named type, to set your entire X-Cart store to operate over HTTPS, you should add the following code to the .htaccess file after the line "RewriteBase":
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
If the canonical URL of your site is known, it will be even better to add the rules as follows:
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://example.com/$1 [^] [R=301,L]
(Be sure to replace "example.com" with your actual canonical URL). The above code should be added before the code for handling Clean URLs.
You can also use the following instructions: https://www.sslshopper.com/apache-redirect-http-to-https.html
Method 2. HTTPS for the entire store - Servers like nginx.conf
Convert the rules cited in Method 1 above to nginx.conf as follows:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
For more info, see:
https://www.bjornjohansen.no/redirect-to-https-with-nginx
Method 3. Enable HTTPS for the entire store - Only recommended if you cannot use Method 1 or Method 2 above
X-Cart versions 4.7.9 and later
To switch your entire X-Cart store to HTTPS, simply select the option 'On all pages' from the 'Use secure protocol (HTTPS)' selector:
https://demo.x-cart.com/demo_goldplus/admin/configuration.php?option=Security#tr_use_https_login
X-Cart versions prior to 4.7.9:
To switch your entire X-Cart store to secure mode, edit the file https.php. Find the line:
function is_https_link($link, $https_scripts) {
and replace it with
function is_https_link($link, $https_scripts) {
return true;
Enable HTTPS for the login, registration, checkout and payment pages
Enable the secure checkout at your store by selecting the HTTPS protocol for the payment methods to be secure on the Payment Methods page. You can also adjust these HTTPS options on the 'General settings/Security options' page:
Enable HTTPS for specific php scripts
If you do not wish to enable HTTPS for the entire store site but just need to secure some php scripts in your X-Cart store so they can only be accessed via HTTPS, you should add the scripts that need to be secured to the 'https_scripts' array in the file <xcart_dir>/https.php. You can find some examples of how that can be done right in the file <xcart_dir>/https.php:
$https_scripts[] = 'login.php'; $https_scripts[] = array( 'cart.php', "mode=checkout", );
HTTPS Proxy
Now, if your web server does not use SSL certificates, and you are running an HTTPS Proxy instead, you may need to make additional settings to enable your X-Cart work over SSL (secure connection). In the include/https_detect.php file, define the proxy IP address and set the $HTTPS variable to 'true':
if ($_SERVER['REMOTE_ADDR'] == '192.160.1.1') {
$HTTPS_RELAY = true;
$HTTPS = true;
}
If you are not sure whether your web server uses SSL certificates or runs behind an HTTPS Proxy, contact your hosting service provider or server administrator or email our technical support - we will help you find that out.
If you experience problems with external services (payment / shipping) working over https while using curl/libcurl as the https module, try adding the following line to top.inc.php:
define('USE_CURLOPT_SSL_VERIFYPEER', 1);
after
$xcart_dir = rtrim(realpath($xcart_dir), XC_DS);
