Encryption: Using SSL with MODx Manager

Brand new to MODx and I’m using it to set up a site for a client.

They have requested that the Manager pages be accessed via SSL.

Sooo... I’m looking for guidance in how I go about doing this. I know that it probably involves the Encryption snippet.

Am I correct that I just need to place the snippet in the template used by the Manager?

And the SSL certificate -- it should be a wild card certificate for the site and placed in the root, correct?

Please, if I am wildly -- or even slightly -- wrong, please set me on the true path.

Thanks!

--
jason sweeney
http://spacemonkeypants.com/

The encryption snippet would only be for forcing specific front-end pages to use SSL (i.e. for payment or feedback forms). The manager should just work under SSL; the configuration of which is going to depend on your server specs and web server configurations.

So, if I have a dedicated SSL certificate, how does it "just work"? Do I need to do anything to ensure that trying to log into "http://mysite/manager" redirects to "https://mysite/manager"? Is a mod_rewrite necessary?

(If ignorance is sniffed out in that question, your nose has not deceived you. All this SSL stuff is brand new to me.)

And thanks for your help.

Probably the manager doesn’t hard code any URLs, so using https://www.mysite.com will work without any changes.
Worst case if it doesn’y work then you could use mod_rewrite.

Andy

However you need to know where the https document root is. For example you may have:

/var/www/mysite/public_html

and

/var/www/mysite/secure_html

so accessing http://www.mysite.com and https://www.mysite.com show different things - essentially two websites. If that is the case if you have shell access (on Linux) you can try deleting the secure_html folder then creating a softlink to public_html. For example:

cd /var/www/mysite
ln -s public_html secure_html

Andy

The thing is, I want the main site to work without SSL.

It is only the the manager pages that should only be accessed through SSL.

Hi, I believe that (depending on the configuration of SSL in the server) you can access both (http and https) at the same time. In that case your users could use http://your-site to view yor site and type https://your-site/manager/ to log into the manager.