SSL Certs

[Paul Mac Eoin]

I've made a website for a friend of mine (www.pauljameskearney.com) and he'd like to be able to sell his art and prints through the site.

Does anyone have experience in purchasing/setting up an SSL cert so transactions are secure and Browsers don't throw tonnes of warnings at shoppers?

Cheers!

Paul

[gerryk]

Let PayPal or some other processor do the payment handling. No need for SSL on his end.

[Mark Grealish]

^

[gerryk]

That said, he's probably going to have an admin login on the site. No harm in having SSL there. Check out cacert.org

[Paul Mac Eoin]

My problem is that before even getting to PayPal, before getting to the checkout one is faced with Chrome (and FF) throwing up a dirty big red warning page.

https://pauljameskearney.com/checkout/   I also don't have https set up I guess. I'll have to figure that one out. I thought SSL certs were related to that.

[Barry Coughlan]

You don't need HTTPS on the checkout page as long as you're using the Paypal Express APIs (i.e. redirecting to the Paypal website).

In the event that you're using direct payment (taking credit card numbers on your checkout page), please know that API is hell on earth, the documentation sucks, and you'll have to go through PCI compliance. Rarely worth it.

[Barry Coughlan]

Just noticed your HTTP checkout page is redirecting to HTTPS. You probably have a rewrite rule set up to do this that sohuld be removed.

[gerryk]

Might be worth checking this plugin out: http://wordpress.org/extend/plugins/wordpress-simple-paypal-shopping-cart/

I am not a WP guy, so I can't vouch for its ease of use or quality... it was the first thing that popped up in a search.

Gonna second what Barry said... when you click the /checkout link in the store, it redirects to HTTPS, which is probably a rewrite rule in .htaccess
That is why you're getting errors about your cert... the browser is expecting a cert for your domain, but the site is providing a default cert.

--

[Paul Mac Eoin]

That's it!

I had "force https" turned on. Sorted now. PayPal should be able to do the rest.

Thanks a million guys, saved me (and the client) money time and effort in sorting out a cert!

[Padraic Harley]

Did you turn it off for there in particular or in general?

Folks, how will that affect login? Aa far as I'm aware, Wordpress doesn't force https for the login.

--
Padraic Harley - Mobile Device

Mobile: 00 353 (0) 85 2138803
Email: pad...@091labs.com
Twitter: @pauricthelodger

[gerryk]

No worries. Do consider securing the administrative login with a cert, though. cacerts.org do free ones, and, whereas you need to install a root CA cert in your browser to prevent it whinging, it is worthwhile doing.

--