PDA

View Full Version : Security Certificate problems when using shared SSL


NickD
20-Jul-2003, 07:52 AM
This problem is already the subject of an enquiry with Actinic, however due to difficulty in reproducing it to find a fix, I'm casting the net a bit wider by posting here. If anyone has experienced this or anything like it, or has any suggestions, please post a response here.

My site (www.nickdobsonwines.co.uk) is hosted with Clara and I use shared SSL, using their secure server, and relying on their security certificate. Following some initial work getting this configured correctly, it has been working fine for many months, with the golden padlock appearing and disappearing as expected and buyers being able to order without difficulty. I just upgraded the site to Catalog 6.1.2 and have had 3 instances of an error message being displayed during the checkout process. I experienced this twice myself, using a PC in my local Library to test the site, and one customer has also reported it. See the attachment for a screen dump of the message (I managed to get this off the Library machine the 2nd time it happened there).

My concern is that customers will be scared away by a message implying security problems; I am sure all site owners would share this concern.

Now I realise that this message would normally be produced where the name of the site does not match the security certificate, because it is a shared certificate for a Claranet site, and that to overcome this problem we try to 'fool' the browser into thinking that my site is a sub domain of the claranet one by setting "Catalog URL" in the SSL settings to

https://clarahost.clara.net/www.yourserver.com/acatalog/

I stress this has been working fine for many months (weel, no prior reports anyway), and it is seemingly only now that this issue has arisen. I cannot reproduce it from my PC, and the guys at Actinic cannot either. Yet it is real enough.

The customer who found this was using Windows XP Home edition, plus Norton Anti virus & Norton Internet security. I am aware that some Norton products (in particular Norton personal Firewall) have been widely reported as causing all sorts of other problems with Actinic, and I wondered if it might be something to do with that. The other PC - in the local Library - has a customised browser for public use, and I was not able to determine the machine config. I would be surprised however if there was not some kind of firewall running on it.

Anyone got any ideas or experienced anything similar?

All input gratefully received

Regards

Nick Dobson:confused:

pinbrook
20-Jul-2003, 02:27 PM
we have a problem site too...v6.1.2 with its own SSL cert. Same error message.

We have had the cert re-issued without sucess

NickD
20-Jul-2003, 08:57 PM
Hi Jo

Do you have any evidence of it being Norton-related?

Nick

pinbrook
20-Jul-2003, 11:02 PM
We don't think Norton is involved.

you should see the error by clicking here (https://www.whenwewereyoung.co.uk)

My teccies don't think it is Actinic or Norton! This cert is not shared

I think I'll withdraw from the thread because I'm not sure that our problems are related

NickD
30-Jul-2003, 10:26 AM
I've been told that this was due to something that has been fixed in 6.1.3 - I've now upgraded to 6.1.3 and hopefully it won't happen again. I will continue to monitor it just in case.

Nick