Commerce Kickstart on secure server

Question

I am in the process of building a Commerce Kickstart 2 site and need some guidance.

From what I can see it is now recommended that e commerce sites are fully hosted on a secure server.

I have in the past looked after a non commerce Drupal site on a standard server.

So my question is apart from having a SSL certificate installed do I need to do any other work to the site or is it a case of just uploading via the hosts control panel onto the secure server as I would with a normal server.

If it's not going to be that easy any advice please

Answer 1

Yes it should be that easy, Drupal doesn't tend to mind what protocol it's served under. I say "should" because who knows what contrib/custom modules you have that might be doing who knows what, but in my experience contrib tends to be pretty good and you can sanity check the custom modules before implementing anyway.

You'll probably want to un-comment the http -> https redirect in .htaccess (or implement similar in the vhost if you're using something other than Apache), that way any errant insecure requests will be upgraded before they hit Drupal.

A useful check is to crawl a test version of the secure site (e.g. with Integrity on a Mac) and look for requests for insecure resources. If you see any, you can check the referring URLs to find out where the insecure request comes from (link, iframe, script tag, etc), and use that as a jumping point to find out which module/sub-system is responsible.

Answer 2

Thanks Clive for your help. I have now managed to get my site setup but did have a few issues so this may be of use to others at some point. The site is a Commerce Kickstart2 on a shared server. The hosting was set up for me and a link to the control panel was provided. On uploading all seemed to be fine, I put the site into maintenance mode and logged out only to then find I could not get back into the site ( by putting user/login ) Next day re installed site and tried again, same thing no login. After some searching I found a way to get back in using phpmyadmin. More searching found Clean URLs needed to get the login to work via the address bar. Also found a comment that Htaccess is used a lot to control Drupal so looked and yes I had one in the files list, But for some reason I opened the file only to find it was empty. What I think had happened is the Htaccess file was created by my host but the Drupal install having found a copy did not replace it. Pasted in the original content and all worked fine. Now for the secure part https in my searching I came across the Htaccess module installed it set to run as secure and all seems to now work. Hope this help someone else.