Securing forum with https

[buksida]

I notice this board is https and has a green secure marker in Chrome.

I would like the same for my own forum as even with https it still does not show as 'secure'.

I have installed the SSL certificates on the server for the domain so what are the next steps?

Thanks in advance.

[Mick]

Have you updated your cookie settings to accommodate SSL? Please supply a link to your board so we can have a look.

FWIW - you’re NOT securing your board with SSL you are merely encrypting the data that is sent and received.

An SSL certificate is a bit of code on your web server that provides security for online communications. When a web browser contacts your secured website, the SSL certificate enables an encrypted connection.

[buksida]

Thanks for the quick reply - here are screenshots for the settings, so no - nothing setup yet.

I do remember trying this before and it messed everything up and nobody could login so we had to disable it again.

Can you let us know what to do to fix it. Cheers.

[fagbutlil]

Change http to https under server settings and purge the cache.

[Mick]

Cookie secure needs enabling, see Knowledge Base - Fixing incorrect cookie settings

Also you can add something like this to the beginning of your .htaccess file to make sure everyone lands on your board using HTTPS:

Code: Select all

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Change http to https under server settings and purge the cache.

That only works if you’ve got force server url settings set to yes.

[buksida]

Trying this on another smaller forum.

Ok - done all that - but as before I cannot login and get a 'site unreachable' error.

Also this still shows in Firefox:

SSL checker says all is good server side so it must be a phpBB config problem:
https://www.sslshopper.com/ssl-checker. ... aboard.com

[Mick]

Please supply a link to your board

[buksida]

Its written in the attachment ... www.burmaboard.com

But when you try to log in this happens:

[fagbutlil]

Once you have your ssl cert in place and changed acp setting and added the htaccess force code open ftp or cpanel and delete the production folder from the cache folder also clear your browsers cache.

I just added ssl to my site.

[buksida]

Its not as simple as that evidently. Caches cleared and we're still getting errors.

[Mick]

Placing https:// at the beginning of your url (https://www.burmaboard.com) works correctly with the padlock etc.

You need to add the .htaccess rewrite, it won’t work properly if you go in using http otherwise.

The Cookie domain burmaboard.com requires a dot in the front, see the cookie KB posted earlier.

[buksida]

If I add the .htaccess rewrite I cant login - I get the "site unreachable" error.

I have done it now - can you please try and register or login?

[3Di]

If I go to http://www.burmaboard.com (HTTP) it correctly redirects me to the HTTPS.

Purge the cache of your browser(s) and try again.

[buksida]

That isnt the problem - logging in is.

We cant log in to the forum.

It only works without the .htaccess rewrite code.

[Mick]

It isn’t redirecting for me, have you got a user test account? Have you spoken to your host about this, there should not be any issues signing in because you’ve gone https if everything is as it should be.