SSL certificates usually match (exactly) one domain name. For example that may be
www.domain.com (which would secure
https://www.domain.com). This would give certificate mismatch browser warnings/errors for
https://domain.com https://subdomain.domain.com etc.
Anything which comes after the domain name in a URL (e.g. in
https://www.domain.com/some/folders/index.php I'm referring to the /some/folders/index.php part) is irrelevant regarding the (in)validity of the SSL certificate - it only concerns the actual domain/subdomain in question.
Note also that there are some certificate authorities which will issue a certificate valid for
www.domain.com and domain.com (in a single certificate) which will help avoid accidental mismatch warnings. Likewise you can also pay a bit extra and buy wildcard SSL certificates which would be valid for *.domain.com (e.g. you can use this certificate to secure multiple subdomains of domain.com). However, you will usually have to pay extra if you want to use a certificate across multiple servers at once.
With that background out of the way, let me answer your specific questions:
Quote:
Originally Posted by orionoreo
|
Quote:
Originally Posted by orionoreo
cool so if i have the ssl for www.mydomain.com it doesn't matter if I set the ssl and non-ssl to be housed in separate folders or not correct? |
This is correct as far as the SSL certificiate issue is concerned. However, you may want to have some control over whether your visitors access a certain page via SSL or not. For example if you want to use SSL on your login page you probably wouldn't want your visitors to accidentally use
http://www.mydomain.com/login.php instead of
https://www.mydomain.com/login.php - this would be possible (by default) if you house all of your content (SSL and non-SSL) together.
On the other hand, if you have SSL and non-SSL directories in use, you will probably need to duplicate some content. For example, your site logo and CSS files etc.
This is because every item loaded into an SSL secured page needs to be over https, so if you load up your images using
Code:
<img src=http://www.mydomain.com/images/logo.jpg</img>
you would find that browsers still give out a warning/error message (exactly what/how this is displayed varies quite a lot between different browsers). This might not be too much of a headache for images, but for your CSS file you might make more frequent changes to this, and therefore it can be a pain to (try to remember to) upload it into two places.
Therefore another option might be to house all content in a single directory, but add a .htaccess file (assuming you're using an Apache server) with a rule to force accesses for
http://www.mydomain.com/login.php onto
https://www.mydomain.com/login.php
This can of course get quite tedious, so if you have several pages to secure it might actually be beneficial to have them as something like
https://www.mydomain.com/secure/login.php which would make the rewrite rule easier (i.e. you could have a rewrite rule which says anything with 'secure' in the URL should be accessed only via https).
