Drupal: how to enable SSL layer on shopping pages ?

Question

It is the first time I'm using SSL for a Drupal-based e-commerce shop.

I need to enable SSL only on the web shop pages, I've found this module for this: Secure Pages.

However I need to know what are exactly the steps I need to perform... should I first

1) Buy SSL certificate at hosting service

2) Enable it.. (Hosting services usually provide a specific folder for https pages. However I cannot split Drupal in two. So I was wondering if I have to copy the entire Drupal installation into this folder and then use Secure Pages to specify which pages should be protected and which pages not ?)

3) After this, am I done ? Or are there additional steps ?

Answer 1

Step 1 and 2 are a must.

Then you can choose from the following:

1. Use Secure Pages http://drupal.org/project/securepages

2. Change Drupal $base_url to https://

3. If your on Apache Server you can use Apache's mod_rewrite

   RewriteCond %{SERVER_PORT} 80

   RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R,L]

   php_value session.cookie_secure 1

Answer 2

Absent weird hosting requirements, all you should need to do is get a certificate, and install securepages.

I'm not sure how a host could require that SSL only be run out of certain directories, unless it's a completely different web root. SSL doesn't know or care where on the server the original script was run.

In either case, give securepages a try and let us know if additional problems appear. On a sane installation enabling securepages should be all you need.