Help with Subdomain

[Chappy]

I'd appreciate any help, if only in understanding. Les has been really cool trying to work this out, but no joy yet.

This problem refers to a file in a subdomain, located here. The subdomain is secure (just bought a new instantSSL via Jag - it was installed) and it is for folks to make small purchases.

The problem is that the page seems to be loading, if only partially, from somewhere other than /public_html/secure/ I have even deleted the file from /public_html/secure/ and it continues to load.

I cleared my cache in both firefox and Ie and it loads in both.

Moreover, the browsers indicate that it is leaving a secure area or that it has both secure and non-secure items. Everything on the page is contained in the secure directory. When I look at the file in /public_html/secure/ via Cpanel file manager, it shows any changes that I make, but they are not reflected when the browser loads.

I used to be with Aletia and was part of the big buyout (thank God) when we moved over and I think I have been moved around in terms of servers since I have been with Jag once or twice. Could it be loading from one of the old servers? Or could it be coming from the /www directory on the same level as /public_html/ ?

Again, I would appreciate any help in trying to figure out where its coming from.

[Chappy]

Oaky, tech support just got back to me (we've been back and forth for the past several days) and said that the files are loaded from /public_html/ not from /public_html/secure/ . I made changes and they were reflected immediately. So, its working now.

I would still ask if someone can help me understand why this is functioning this way? I have a cert installed for secure.elderhope.com . The files are loaded from the /public_html/ directory and not from the /public_html/secure/ directory. Why? I was loading the files up into the secure directory. Should I point the secure subdomain to the secure directory? Would it make any difference in security?

I just don't get this subdomain stuff.

[jason]

It looks as thouugh they just set up secure.elderhope.com to point at public_html instead of secure. This allows you to secure your entire site if you wish, not just one directory.

The way that CPanel works is that, when you create a subdomain, it sets up Apache to serve the files for that subdomain from a directory with the same name as the subdomain name, but there is no requirement that things be done this way. It is just a logical way to do it. All that a domain name is is a pointer to a computer on the Internet. Any name can be pointed anywhere. Domain names only point at computers (actually, IP addresses). Once a request comes in it is up to the computer to figure out what to do with it. In the case of Apache there is a configuration file that lists every domain name that the server knows about. It scans this list and tries to match the requested domain to a directory somewhereon the server. In the case of your setup, elderhome.com, www.elderhope.com, and secure.elderhope.com all happen to be pointing at your public_html directory.

I hope this helps you understand what's going on. What you are really doing is mapping a new name to your main website instead of a true subdomain, in the CPanel sense of the term.

--Jason

[Chappy]

As always, thanks Jason for your help.

If I may ask one more question. Then the cert that I bought for secure.elderhope.com will serve secure pages from /public_html/ , right? I guess I'm still not quite sure how the SSL cert fits into this whole thing. You explained very well the subdomain question.

[jason]

The certificate has nothing to do with how your domain resolves. It is just there to provide the fingerprint that the encryption based upon. Each certificate has a unique finger print (key) that is used for doing the encryption. The only way to decrypt the data that you receive is to know that key, and no one but you (your server, actually) would know that.

Certificates serve a second purpose, too, though. When a company like Comodo (who sell the InstantSSL line) issues a certificate, they do a background check on your organization to make sure it is legitimate. By issuing the certificate, Comodo is saying "we trust that Elderhope is a legitimate organization and that they are the rightful owner of secure.elderhope.com, so you (as in website users) can trust that anything you send to that website won't end up in the wrong hands." In other words, buying a certificate from a third party (as oppsoed to using your own self-signed version) is telling your customers that they can trust that you are who you say you are.

secure.elderhope.com and www.elderhope.com resolve to the exact same place (public_html). If fact, you can use secure.elderhope.com (without the https) just as you do www: http://secure.elderhope.com/modules/news (non-encrypted) or with the https to browse any part of your site securely https://secure.elderhope.com/modules/news.

--Jason

[Chappy]

Jason, that really helped clarify what was going on. I tried to find out more about this by searching forums and web sites but it didn't make much sense until you explained it. That's the value of these forums. Again, thank you!

[jason]

Chappy,

You're welcome. I'm always glad when I can share some of my knowledge.

--Jason