January 27th, 2003, 04:26 AM
I am uploading a PHP MySQL site to my webhost. This uses a shared certificate. The webhost admin has asked me to put any files that need an SSL connection in a separate folder so they can "move" them to the secure server.
Is this standard practice??
My site has hundreds of files, many of which will need a secure connection for certain processes, but to separate them from the rest of my files would be a total nightmare!!!
Have i been had?
My understanding was that SSL is a connection, not a location..??
Any help/advice would be greatly appreciated!
January 27th, 2003, 05:09 AM
Who is your host? In most cases the only thing that needs to be done to enable the SSL is ŧ https instead of ŧ http for your links - but, thats in most cases.
There are some hosts that do require the files to be in a seperate folder and then called as ŧ secure.yourdomain.com/file.php. So, to answer your original question 'is it normal' - no, but in some cases is needed.
~ Joe Penn
January 27th, 2003, 12:43 PM
it is normal to use a special folder (or even a special ftp account) for SSL. but itīs not normal that they move the files there.
maybe they didnīt manage to setup SSL correctly and this is their workaround... also maybe they consider this "more secure". (haha)
January 28th, 2003, 03:52 AM
Yeah... that is how my files are set up.... (php).
Well.... i am waiting for a reply from them... i just asked them why.
I can just see months of work if i have to change every ssl reference in my files..... I'll give them the benefit of the doubt before I'll name them.
February 1st, 2003, 05:12 PM
Well, I wrote to my provider asking why these files have to be moved.... they replied:
"Your files need to be moved/copied because SSL is not enabled on the
server you are currently hosted on. SSL is enabled with a shared SSL
certificate on another server. To make your site work with SSL on the same
server you would need to purchase your own dedicated SSL certificate that
we'd install for your site."
The page where i signed up for the account was worded thus:
500 MB server space
4 GB monthly transfers
Linux or NT server
Remote control via web
.htaccess protection (Linux)
75 POP boxes
Unlimited email aliases
Unlimited email destinations
Unlimited auto responders
Urchin 4 site statistics
Own CGI-BIN (Linux)
FrontPage extensions (NT)
Allaire Cold Fusion support (NT)
server side languages
Perl support (Linux)
PHP4 support (Linux)
ASP support (NT)
MYSQL database support (Linux)
Access database support (NT)
quality of service
24/7 server monitoring
UPS power backup
No mention of a separate server for the SSL. This is just a total pain. Any more feedback from experienced people would be greatly appreciated..... I am on a Linux box for the above btw.
I have "https" for the links that require ssl..... but can see a whole lot of painful work if I have to start actually changing the physical location of some of my files.
February 1st, 2003, 05:22 PM
you're on linux. nothign is a hard task there....
for i in /home/www/htdocs/*; do cat "$i"|sed s/www\.yourdomain\.com/www.newdomain.com/g" >/tmp/mytmpfile; cat /tmp/ mytmpfile > "$i"; done
February 2nd, 2003, 12:05 AM
Thanks but......I'm sorry.... I do not understand that at all.... where and how it is done, or what it achieves
February 2nd, 2003, 03:14 AM
i refered to this:
the script takes every single file from a folder (/home/www/htdocs/*) and replaces "www.yourdomain.com" with "www.newdomain.com".
i wanted to say: why do you need "painful work" for changing the location of your files? is the structure actually that complicated?
February 2nd, 2003, 04:45 AM
Oh... ok.... I do not have that kind of access to the server, and that is not what I need to do.
Yes, the structure is that complicated..... I currently have 336 PHP files in an ordered directory structure. There are 854 calls to a connection FUNCTION which chooses between HTTP or HTTPS in 137 of these files.
My host wants me to place anything that requires SSL in a separate folder in my root directory so that *they* can move them to an entirely different server. (I expect I will not have direct access to them anymore which will interfere with further development)
I cannot comprehend the need for this at all. To me it is just a secure connection .... all I need is the server path for HTTPS..... my files can stay exactly where they now reside.
February 2nd, 2003, 08:15 AM
The problem actually is that a SSL certificate is bound to one domain. You canīt just create a certificate, you have to buy it from one of the companies whose root-certificate comes pre-installed with all the common browsers or one of their resellers.
yes, you can just setup any certificate, but the users will be told that it is faked and asked if they still want to enter your site.
certificates usually have to be renewed yearly, so this costs some $100 per year.
That probably is why you donīt have your own SSL server.