Need help with a SSL connection (badly)...

[chazdraves]

Allright, well I'm the webmaster for a brand-new up-and-coming financial news website, and, for our subscription service, we'd like to have an SSL connection that allows the users to sign up for our site using their credit cards. We purchased an SSL connection and merchant gateway, etc., etc., etc. from Wells Fargo, which uses (like everyone else) Authorize.net to authorize the credit card transactions. I have no experience whatsoever with using an SSL connection or accepting any form of payment for a service. I know anything HTML, but this stuff baffles me. To start with, we just want to set up a basic form that will allow them to enter in their name, credit card, expiration, etc. and then they can (over a secure connection) hit the little "Proceed" button which sends us an e-mail with all the information that they just entered in the form above. We will then process all of the information ourselves, we'll type in their information at Authorize.net and let them know via e-mail if they were approved, etc., etc. My question then is this (after that huge amount of background information): How the heck do you make a webpage use an SSL connection? Thank you for your time, and thank you (hopefully) for your answers. Later

- Chaz

 

[DaveSimmons]

If the certificate is installed on your server, did you try making a link to your form page with the A HREF as ="https://" instead of "http://" ?

 

[chazdraves]

Understanding that I've never done SSL, or even seen any code related to SSL, no, I did not try that. Thanks for the advice. I have no idea how to do any of this SSL stuff. Essentially, it's all Greek to me. Heh. Soooo... when I link to the page that I want to use the forums on, (example http://www.mysite.com/forum.html) I should instead link to https://www.mysite.com/forum.html? Thanks again!

- Chaz

 

[DaveSimmons]

Exactly! It seems almost too simple, but if the cert is installed and the webserver is configured to allow SSL in general, that's all you do.

However, if your form page is using "mailto:" then even though the page was sent encrypted, the mailto itself will not be. Used that way a https connection is pointless and misleading.

To have the form data sent securely you must POST the results to a script page (ASP, Perl, etc,) using something like
< form action="https://www.mysite.com/my-process-script.pl" > . Your script gets the form data then either writes to a file or database (hopefully encrypted for when your site is hacked) -or- uses sendmail to forward the data by email (again hopefully encrypted so the previous secure connections weren't pointless).

But at least step 1 was easy 😉

FYI for data encryption in Perl there is a Blowfish private-key encyption package that's free. Probably one for ASP too.

 

[chazdraves]

Certainly more simple than it seems! My question then, is this: How do I get the information to the Authorize.net website so that they can approve/deny the credit card? I think the big question has been answered, for which I am most gracious. I also have a 41-page instruction manual from Authorize.net which I believe tells me exactly how to do what I need to do, it's just a matter of learning how to do what is required to be done. (that was a mouthful). Is there any easy way for a new website with an unfamilar webmaster to process credit cards? (besides PayPal) Or is this really the best ways to go about it? Thanks again for all the help!

- Chaz