I've been reading a lot about this and trying many of the methods I've found and haven't yet been able to get anything working properly.
I want to be able to secure the admin area and associated login pages. So anything in example.com/admin/* or example.com/user/* etc, needs to go over SSL/TLS. We'd like this to apply to each site withing the multisite setup. So example1.com, example2.com, example3.com are all on the same server/user account.
- Drupal 7 multi site
- Clean URLs enabled
- PHP 5.3
- MySQL v14 d5
- Securepages is not an option, as there's no stable Drupal 7 release, and using the existing dev version requires patching Drupal Core, which goes against our policy
- Have tried Session 443 with no success
- Have tried Secure Login with no success
- An SSL cert (a self-signed one for now, while testing) is installed and works on the server for other purposes, just not Drupal.
- I've read all the docs on Drupal.org about enabling HTTPS and have attempted to follow the directions there with little success
- I've toggled the $conf['https'] setting in settings.php with no discernable results.
If I enable HTTPS for everything on a site, I get a 404 for anything attempting to go through https://, which leads me to think that the rewrite rules aren't applying for the https pages. What am I missing here? Is there a rewrite condition/rule I can add to htaccess to fix this?
Is this not a solved problem in the Drupal community? Are people just leaving their admin areas unsecured, with user passwords being sent in the clear? I find this hard to believe, yet it seems that there's no built-in or commonly known solution to the problem.