PHP and SSL 1

[Bastien]

Hi All,

I am trying to figure out how to make php use ssl to lock the browser. with asp this is easy, but none of the references I have found so far explain it very well if at all. Most deal just with getting SSL running on the server but not how to incorporate the certificate mechanisism into a web page.

Any idea, hints or examples will be greatly appreciated.

TIA Bastien

There are many ways to skin this cat,
but it still tastes like chicken

 

[devnull22]

SSL is webserver base. ie. you need to install a SSL webserver. Ken

http://www.photoflux.com

http://www.clickEval.com

 

[Bastien]

I understand that and the host that I plan to use has it installed and set up. What I am looking for is the way to invoke it, ie to make the lock symbol come up in the browser.

If you code post some code showing this, I would appreciate it. I can't locate anything on it at all.

Or is it where in the webserver that I post the pages to. ie if I put them in the SSL webserver, this happens automatically? It can't be that simple, can it???

TIA Bastien

There are many ways to skin this cat,
but it still tastes like chicken

 

[rycamor]

SSL is just a protocol. It's not a program you invoke. All you need for the "lock" to appear in the browser window is to access the server with

https://servername,

instead of

http://servername

(as long as that server has SSL). It really has more to do with Apache than with PHP.

I'm sure Microsoft/ASP has come up with a cute way to "invoke" the SSL server, but that is really just a matter of redirecting the browser to an

https://etc...

URL. You can do it with one line of PHP just by doing something like

header("location: [URL unfurl="true"]https://servername/thepage.php");[/URL]

. I suppose it wouldn't be too hard to create a function that checks for the protocol being used, and automatically redirects the browser to https, but really, that can be configured right in Apache. PHP pretty much works transparently to http or https, so it's purely a matter of how you link the pages, or how you configure Apache. (for example, you can configure Apache to only allow HTTPS protocol in certain directories, etc... and provide a redirect if the browser tries to access with plain http.)

It's a big subject, though, and you should probably spend some time in the Apache forum, and maybe in the "General Security Discussion" forum.

 

[Bastien]

thanks...that make sit clearer

Bastien

There are many ways to skin this cat,
but it still tastes like chicken