RPS Posted January 25, 2008 Share Posted January 25, 2008 With the current way WHMCS handles SSL, your clients can log in on pages that are not via SSL. There are also other areas that WHMCS forces to use http instead of https (I believe the announcements and knowledgebase are both without https). You can use .htaccess to force everything to happen via https, however, file downloads will NOT work if this is the case. When you try to download a file using rewrite rules that forces your URL to be https, IE has an issue with downloading files (in this case, the downloads page). Open 'Configuration' -> 'General Configuration' Set WHMCS System URL to https://www.domain.com/whmcs/ (note the s within https) Set WHMCS SSL System URL to empty The follow code (which you should place inside your .htaccess file), will force all requests to the WHMCS folder to be done via https, unless it is the whmcs/dl.php file. The code after, will force the whmcs/dl.php to redirect from https to http. RewriteEngine on Options +FollowSymlinks #Rewrite the URL for WHMCS to always use https except for the whmcs/dl.php file RewriteCond %{REQUEST_URI} !^/whmcs/dl.php [NC] RewriteCond %{REQUEST_URI} ^/whmcs/ [NC] RewriteCond %{SERVER_PORT} !^443$ RewriteRule ^(.*)$ https://www.domain.com/$1 [R=301,L] #Rewrite the URL for WHMCS dl area to always use http RewriteCond %{REQUEST_URI} ^/whmcs/dl.php [NC] RewriteCond %{SERVER_PORT} !^80$ RewriteRule ^(.*)$ http://www.domain.com/$1 [R=301,L] 0 Quote Link to comment Share on other sites More sharing options...
ruskyhost Posted January 26, 2008 Share Posted January 26, 2008 This worked great!, thanks. Dave. 0 Quote Link to comment Share on other sites More sharing options...
idweb Posted February 3, 2008 Share Posted February 3, 2008 Agree with ruskyhost, this worked great. Was getting certificate error before I tried this now no problems. Thanks !! 0 Quote Link to comment Share on other sites More sharing options...
rosend511 Posted February 11, 2008 Share Posted February 11, 2008 This is not working for me. I did the config thing, edited the .htaccess and nothing. Someone help please... 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted February 11, 2008 Author Share Posted February 11, 2008 What do you mean by "not working" When you bring your car into the mechanic shop, do you simply tell the mechanic that your car "isn't working" ? 0 Quote Link to comment Share on other sites More sharing options...
rosend511 Posted February 11, 2008 Share Posted February 11, 2008 http://www.cod4gs.com/my/ Go try to order something with Google Checkout. You will see what I mean. I think the problem is that I have an old certificate on there, but I did not know how to check and take it off. Help.... 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted February 11, 2008 Author Share Posted February 11, 2008 Your SSL cert is for dindarahosting.com, not cod4gs... You need to contact your host to fix this. 0 Quote Link to comment Share on other sites More sharing options...
rosend511 Posted February 11, 2008 Share Posted February 11, 2008 they dont know how. 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted February 11, 2008 Author Share Posted February 11, 2008 they dont know how. - Find a new host then It's like asking your auto mechanic to replace your tire, and the guy looks at you and says "I don't know how to replace a tire" 0 Quote Link to comment Share on other sites More sharing options...
rosend511 Posted February 12, 2008 Share Posted February 12, 2008 well im my own host, so how do i do it. i have full access cpanel. 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted February 12, 2008 Author Share Posted February 12, 2008 well im my own host, so how do i do it. i have full access cpanel. - Ask in cPanel forums or WHT, not here in WHMCS. It's a hosting problem. Honestly though, if you don't know how to manage your server, you need to hire a server admin. 0 Quote Link to comment Share on other sites More sharing options...
PPH Posted February 12, 2008 Share Posted February 12, 2008 well im my own host, so how do i do it. i have full access cpanel. Currently it appears you suspended your own site? http//www.cod4gs.com/my/ currently loads: http://nsanewebhosting.org/suspended.page/ 0 Quote Link to comment Share on other sites More sharing options...
JasonO Posted February 12, 2008 Share Posted February 12, 2008 Maybe when he said he was his own host, he meant he was only a reseller? 0 Quote Link to comment Share on other sites More sharing options...
PPH Posted February 12, 2008 Share Posted February 12, 2008 Maybe when he said he was his own host, he meant he was only a reseller? Yeah could be since they also said: i have full access cpanel. 0 Quote Link to comment Share on other sites More sharing options...
tropicalwebshop Posted March 7, 2008 Share Posted March 7, 2008 Is this fix still necessary with the release of Version 3.6? 0 Quote Link to comment Share on other sites More sharing options...
jnet Posted March 7, 2008 Share Posted March 7, 2008 I should use ssl but I just am afraid it might make my pages slow 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted March 7, 2008 Author Share Posted March 7, 2008 Is this fix still necessary with the release of Version 3.6? - It is only required if you want to protect your pages via SSL. WHMCS only protects certain pages, I feel that more should be under SSL. 0 Quote Link to comment Share on other sites More sharing options...
danami Posted March 7, 2008 Share Posted March 7, 2008 The big problem with the current implementation of WHMCS is that when you set the SSL URL it should actually force you to use SSL when viewing the admin backend. Right now even with the SSL URL set .. an admin can login and view client/data, CC's all not using SSL. Might be a good idea to change this, but if you are using SSL you should add this to your .htaccess (make sure that mod_rewrite is enabled) to redirect all admin access to go over SSL: # Force SSL over admin area RewriteEngine on RewriteCond %{SERVER_PORT} ^80$ RewriteRule ^whmcs/admin(/.*)?$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L] 0 Quote Link to comment Share on other sites More sharing options...
jnet Posted March 7, 2008 Share Posted March 7, 2008 how much should I buy ssl can any body please guide me? I do not need the best one just the basic will do thanks 0 Quote Link to comment Share on other sites More sharing options...
jeffs Posted March 9, 2008 Share Posted March 9, 2008 Good Post. jnet, simply search "ssl certificates" in Google, you will find tons of results. 0 Quote Link to comment Share on other sites More sharing options...
Brett Posted March 10, 2008 Share Posted March 10, 2008 how much should I buy ssl can any body please guide me?I do not need the best one just the basic will do thanks Have a look at Namecheap.com They have certs starting at $12.88 0 Quote Link to comment Share on other sites More sharing options...
Blitztek - Sergio Posted March 12, 2008 Share Posted March 12, 2008 The big problem with the current implementation of WHMCS is that when you set the SSL URL it should actually force you to use SSL when viewing the admin backend. Right now even with the SSL URL set .. an admin can login and view client/data, CC's all not using SSL. Might be a good idea to change this, but if you are using SSL you should add this to your .htaccess (make sure that mod_rewrite is enabled) to redirect all admin access to go over SSL: # Force SSL over admin area RewriteEngine on RewriteCond %{SERVER_PORT} ^80$ RewriteRule ^whmcs/admin(/.*)?$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L] I have done as the OP instructed to do. However, I do not need to make the .htaccess file with all that code (from OP, and yours). But everything still goes over SSL (pages are all secure -- including the downloads page. Is this something that happens from within the system (pages not encrypted), or do i have to write the .htaccess file. Currently, if i have WHMCS system url as just http, and the SSL system url as 'https', the pages will NOT secure, but the admin panel will be. (if you go to https page, it will redirect to http. Any idea why? Currently, i have system url as https, and ssl system url as http, and it works fine. 0 Quote Link to comment Share on other sites More sharing options...
RPS Posted March 12, 2008 Author Share Posted March 12, 2008 However, I do not need to make the .htaccess file with all that code (from OP, and yours). - Why not? Is this something that happens from within the system (pages not encrypted), or do i have to write the .htaccess file. - Some links WHMCS use will go over http... Currently, if i have WHMCS system url as just http, and the SSL system url as 'https', the pages will NOT secure, but the admin panel will be. (if you go to https page, it will redirect to http. - Instructions in OP say to: Open 'Configuration' -> 'General Configuration'Set WHMCS System URL to https://www.domain.com/whmcs/ (note the s within https) Set WHMCS SSL System URL to empty 0 Quote Link to comment Share on other sites More sharing options...
Blitztek - Sergio Posted March 13, 2008 Share Posted March 13, 2008 - Why not? Because with just doing: Set WHMCS System URL to https://www.domain.com/whmcs/ (note the s within https)Set WHMCS SSL System URL to empty It works fine without the .htaccess 0 Quote Link to comment Share on other sites More sharing options...
danami Posted March 13, 2008 Share Posted March 13, 2008 All that code does in the .htaccess file is FORCE your admin users to use ssl. If you already call https then yes it will use it. Without it you or your admin staff might forget to use https and your data will be sent unsecure. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.