Regarding Keuth Stropus's general questions about SSL
> Is it legal?
You live in the Land of the Free, so everything is allowed unless it's
forbidden. Check with the Feds or whoever if you're really worried, but
since every man and his dog has an SSL-enabled site these days, I
wouldn't lose any sleep over it.
> Do I have to use https:// for my whole site?
To quote from "Apache: the definitive guide", by Laurie and Laurie
(published by O'Reilly):
"It's rather bizarre that the *client* is expected to know in advance
that it is going to meet an SSL server and has to log on securely, but
that's the way the web is."
They go on to explain that the usual way to do things is to have a link
on a normal HTTP page which says: "Go to our secure site" and this link
includes the "https" so that the user never has to type it in.
Thereafter you have to have https in the URI to ensure SSL
communications.
Note that SSL is quite heavy on the system (all that encryption and
decryption) so you might like to send some content (such as logo GIFs)
by plain HTTP. To do this you can either refer to them explicitly, e.g.
<img src=http:/your.site.com/images/my_logo.gif>
or use mod_rewrite to rewrite the URLs. See a previous thread on this
topic:
http://www.mail-archive.com/modssl-users%40modssl.org/msg08015.html
Best regards,
owen Boyle.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
