Store uses SSL but product images do not

[ellermanj]

I have just set up a shopsite store through Bluehost, and it mostly works well. I have purchased an SSL certificate, and enabled SSL for the store and merchant interfaces.

The only trouble I have is that when I view the main product page, the whole page is secured in SSL except for the images of the products. The images all display fine in Firefox, but with IE my local security settings seem to block the non secure images embedded in an otherwise secure page. As a result, the product images are not visible and appear as placeholders only.

Everything else works fine, including button images, etc.

I've disabled SSL for the shopfront, and enabled it for the checkout, and this seems to work fine, except for two things. Firstly, order emails to the merchant and order merchant interface complains the store is not using SSL (althoughthe important bits are). Secondly, customers may be unsettled by the lack of SSL on the product pages, and think the whole site is similarly unsecured.

Is there any way to turn on SSL for the product images in the product pages, and use SSL throughout for everything, site images, product images, and everything else? My hosting settings are as follows:

Use SSL security in Shopping Cart = TICKED
Shopping Cart secure URL: https://www.entrapro.com.au/store/sc
Secure Store URL: https://www.entrapro.com.au/store

Use SSL security in ShopSite (Merchant Interface) = TICKED
ShopSite secure URL: https://www.entrapro.com.au/store/ss
ShopSite Images secure URL: https://www.entrapro.com.au/store/shopsite-images

Merchant CGIs URL: https://www.entrapro.com.au/store/ss
Shopping Cart CGIs URL: https://www.entrapro.com.au/store/sc

All product images are in the /store/media folder.

[Jim]

In order to have your store pages secure and have the images on them secure you would have to have an authorization file that uses the secure url instead of a non secure url.

However there is really no reason to have the store pages use a secure url since there is no information on them that needs to be secure. In fact by having the pages secure you add extra processing to the server since it must encode everything on the pages when it sends it to the shopper's browser. The only screens that need to be secure are those where a shopper enters personal information or payment information all other screens don't need to be secure.

The url for all images on your store pages is based off the url in your authorization file so unless you have a secure url in the auth file you won't be able to get secure urls on store pages.

[ellermanj]

Thanks for the reply Jim, and I agree with everything you have said from a technical perspective. The problem is that if I have secured the checkout process and left the main store pages unsecured, the email that comes from the shop to the merchant when an order is placed is prefaced with the following:

*** WARNING! Your shopping cart is not taking orders using a
secure connection (e.g. SSL or HTTPS://) To configure SSL in
ShopSite go to Preferences and click on Hosting Service. ***

However, if I place a test order myself, it does appear that the checkout pages are secure. The problem is that for a non technical merchant, they will likely be a little unsettled by this message, and think there is a security problem with their store.

I'd like to confirm that this message does not actually mean what it says before telling the merchant to ignore it. Can this message be safely ignored?

[ellermanj]

Don't worry Jim, I just reset the secure settings to how they were before (secure checkout and unsecure store product pages) and I no longer get those error messages in the email. It must have been something I did wrong, but it all works exactly as I wanted now, with SSL on the checkout pages. Thanks again for your assistance!