3

I use flexible SSL in cloudflare and go to https of my magento site. The site loads but the theme is not loaded. Checked the source code and realize the css and js was loaded in http instead of https. I found an article from cloudflare and realized it is due to connection from cloudflare to web server is in http thus css and js src is in http.

I try to set the Base Link URL, Base Skin URL, Base Media URL and Base JavaScript URL started with //domain.com so that it will load assetts in same protocol as the main page in magento admin but it does not allow me to save. So I edit the core_config_data table directly and set Base Link URL, Base Skin URL, Base Media URL and Base JavaScript URL to started with //domain.com. Clear the /var/cache and /var/session and the site loaded nicely.

However I'm not sure what I did is correct way to using cloudflare free ssl with Magento, and what will be the consequences of this way? Anyone with experience using cloudflare free ssl on magento?

  • FYI, I didn't change anything other than editing the 4 cells in the core_config_data table. Use Secure URLs in Frontend and Use Secure URLs in Admin remain as "No" Path | Value web/unsecure/base_link_url //www.domain.com/ web/unsecure/base_skin_url //www.domain.com/skin/ web/unsecure/base_media_url //www.domain.com/media/ web/unsecure/base_js_url //www.domain.com/js/ – Ken Nov 24 '15 at 11:17
  • update: I've setup my store with an SSL cert and configure the magento backend as this . However, when I access the store directly, bypassing cloudflare [grey cloud] I can access to the store main page as http/https and 'my account' with https, but when I enable cloudflare [orange cloud], accessing the main site with http is working fine, access with https will strip all the style (js and css loads in http instead of https) and firefox gave error "The page isn't redirecting properly" when accessing 'my account' with https. – Ken Dec 2 '15 at 5:42
  • update: After I change the SSL setting in cloudflare from flexible to full. It solved the redirect loop. – Ken Dec 2 '15 at 6:20
1

SSL is managed from the web server (apache, nginx, etc..). Magento has only to know if the domain has a ssl certificate. So, once you changed the fields like below, in core_config_data table:

web/unsecure/base_url => http://www.yourdomain.com
web/secure/base_url => https://www.yourdomain.com

magento will run perfectly! Of course, you have to set YES in "Use Secure URLs" in Admin. Other fields can stay like this:

web/unsecure/base_link_url => {{unsecure_base_url}}
web/unsecure/base_skin_url => {{unsecure_base_url}}skin/
web/unsecure/base_media_url => {{unsecure_base_url}}media/
web/unsecure/base_js_url => {{unsecure_base_url}}js/
web/secure/base_link_url => {{secure_base_url}}
web/secure/base_skin_url => {{secure_base_url}}skin/
web/secure/base_media_url   => {{secure_base_url}}media/
web/secure/base_js_url => {{secure_base_url}}js/
  • Isn't it this way I need to install ssl cert to my web server? FYI I want to use the cloudflare free ssl, connection from my server to cloudflare is not encrypted, connection from cloudflare to visitor is encrypted with cloudflare cert. – Ken Nov 24 '15 at 16:59
  • I use cloudflare, but I have my ssl cert installed on my server and setup in magento as described here. Basically, if I lost cloudflare everything would keep working, just a little slower. I think that's a good way to do it, so I'm not tied to their cdn. I love cloudflare and it's working great...I'd suggest you setup ssl on your server where you can control what pages uses and which don't. You should offer https for your visitors and I think setting it up on your cdn only offers the illusion of https with an insecure transmission behind the scenes. – RightClick Nov 24 '15 at 18:40
  • @RightClick I've setup my store with an SSL cert and configure the magento backend as this . However, when I access the store directly, bypassing cloudflare [grey cloud] I can access to the store main page as http/https and 'my account' with https, but when I enable cloudflare [orange cloud], accessing the main site with http is working fine, access with https will strip all the style (js and css loads in http instead of https) and firefox gave error "The page isn't redirecting properly" when accessing 'my account' with https. – Ken Dec 2 '15 at 5:39
  • you can have your js and css always load over https. That way it works even if cloudflare caches the unsecure content. Is that what is happening? There are some https settings in cloudflare you might need to change. – RightClick Dec 30 '15 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.