Creeva’s World 2.0

So I’ve talked about my host­ing provider before, their tech sup­port isn’t the bright­est crayons in the box.  It seems what­ever issue I have with them, they don’t read what exactly I want.  Key word analy­sis is great guys, I did it when I worked phone sup­port at Syman­tec.   What I didn’t do is mis­in­ter­pret every­thing the cus­tomer said on every sin­gle issue.    If some­thing isn’t work­ing you have to fix it.

Warn­ing for the non-geeks that read my site, this is about to get technical.

Let’s go back to the begin­ning and flash for­ward to present day.    In Sep­tem­ber I really wanted to imple­ment SSL for the admin­is­tra­tion sec­tion of my blog — sim­ple, easy, and secure.   The biggest rea­son for this was the Word­press 2.7 series offered bet­ter sup­port for SSL, so now why the time to imple­ment instead of hack­ing around with plu­g­ins for sup­port.  This turned out to be not so simple.

Online I found my host­ing provider is sup­posed to offer a server self signed cer­tifi­cate, so I sent the fol­low­ing mes­sage to tech support:

Is there a shared server cer­tifi­cate for SSL that I can use for my word­press installation?

Now I’m fast and will­ing to pick through things on my own, so before tech­ni­cal sup­port could reply I added this sec­ond mes­sage to my brand new ticket.

I found the SSL man­ager in cpanel -

1.  Do you have instruc­tions on prop­erly gen­er­at­ing your SSL key for use with
this (word­ing might be wrong — but how to con­fig­ure this so I can use it with
my creeva.com domain?

2.  Do you instruc­tions on using this with wordpress?

Sim­ple and straight for­ward I thought.    Here is what I got back:

Hello,

If you install the  shared SSL for the domain, you will be get­ting warn­ing when
you take the site.

It is bet­ter to pur­chase SSL from third party godday.

Please check the link given below for installing SSL.
http://www.cpanel.net/support/docs/11/cpanel/sec_ssl.html

In case you have any more queries, please don’t hes­i­tate to con­tact us with
all the required details. We’ll be happy to assist you further.

Let’s throw the lit­tle bit of bro­ken eng­lish aside for a moment and break this down.  I am aware (of course they don’t know this) that I will be get­ting a cer­tifi­cate mis­match error when I login to the SSL site.  Prob­lem one I see is that they are send­ing me a third party, yet they sell an SSL ser­vice — I find this odd, but Godaddy (I’m assum­ing that was what he meant) is cheaper.  Good cus­tomer ser­vice?  Maybe.  The other prob­lem is that he sent me the instruc­tions to doing this in Cpanel 11, all fine and good, but they have all of their cus­tomer on Cpanel 10.  The instruc­tions were sim­i­lar and I fol­lowed them.   After imple­ment­ing the changes I attempted to go to my web­site on HTTPS.   Fire­fox through out the fol­low­ing message:

Secure Con­nec­tion Failed

An error occurred dur­ing a con­nec­tion to creeva.com.
SSL received a record that exceeded the max­i­mum per­mis­si­ble length.
(Error code: ssl_error_rx_record_too_long)

The page you are try­ing to view can not be shown because the authen­tic­ity of
the received data could not be verified.

* Please con­tact the web site own­ers to inform them of this problem.

I spent a day research­ing this mes­sage, BTW Firefox’s doc­u­men­ta­tion of error mes­sage is ter­ri­ble, hence why it took me a day instead of min­utes.   Also Firefox’s doc­u­men­ta­tion is wrong as I would find out later.  After a few days of try­ing to get this to work I gave up and wrote this off as a lost cause for the moment and focused on other things.

Flash for­ward to yes­ter­day, I decided to reopen this ticket since again I wanted SSL.  I knew from expe­ri­ence that the shared cer­rtifi­cate would not work prop­erly, so I went and gen­er­ated a free (valid) one from Instant SSL.  I wanted to do this before pur­chas­ing my own SSL cer­tifi­cate from Godaddy, just to make sure every­thing was work­ing prop­erly.   I went through all of the steps and I go thte same error mes­sage.  Well I saved the thir­teen dol­lars a valid cer­tifi­cate would have cost, but wasn’t any closer to my end goal of an encrypted Word­press admin­is­tra­tion sec­tion.  I still wanted this so I opened the orig­i­nal ticket back up (tech sup­port hates that BTW) and added the fol­low­ing note:

I’m back to this again — I was con­sid­er­ing buy­ing SSL instead of using the
shared cert — but hav­ing applied a cert from Comodo — I’m get­ting the same
error in firefox:

Secure Con­nec­tion Failed

An error occurred dur­ing a con­nec­tion to creeva.com.
SSL received a record that exceeded the max­i­mum per­mis­si­ble length.
(Error code: ssl_error_rx_record_too_long)

The page you are try­ing to view can not be shown because the authen­tic­ity of
the received data could not be verified.

* Please con­tact the web site own­ers to inform them of this problem.

If I try Inter­net Explorer it doesn’t even connect

If I use dig­icerts SSL checker — http://www.digicert.com/help/ I get this:

DNS resolves ‘creeva.com’ to 69.4.229.212
No cer­tifi­cates were found.
Out­put from ‘openssl s_client’ com­mand:
13127:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol:s23_clnt.c:585: CONNECTED(00000003

Now fol­low­ing godaddy’s instruc­tions it seems I need access to cpanel WHM -
which is some­thig from a shared host­ing per­spec­tive I need you to imple­ment.
Can I get this done — also I’m per­fectly fine using a self signed server
gen­er­ated cert (which is what it cur­rently is right now)

Since I’m not using a shop­ping cart and I’m only going to use SSL for
main­te­nance of word­press, it’s per­fectly fine for me to receive the secu­rity
excep­tion warn­ing in fire­fox since it will not be a cus­tomer fac­ing error, I
only want the encryp­tion side, not the non-repudiation side of SSL.

Also the instruc­tions you sent me are for Cpanel 11 — cur­rently my account uses
cpanel 10 when I login

For those tech­ni­cal peo­ple that under­stand what I’m try­ing to accom­plish, am I unclear on this?  Please excuse my mud­dled use of non-repudiation.  Also that stu­pid Fire­fox mes­sage I stated was vague, well it seems the server wasn’t even com­plet­ing the con­nec­tion prop­erly — stu­pid Fire­fox error mes­sages.  This is the response I got back:

For installing a ded­i­cated SSL cer­tifi­cate on your domain, you will have to
pur­chase a sta­tic IP(dedicated IP) for your domain. For that you need to
con­tact our billing depart­ment.
After obtain­ing a sta­tic IP, we will assign that IP to your domain. You can
upload  your cert , key and CA bun­dle  for the site to the server so that we
can install the cert for you.
Also please note that there will be some down­time for the site until the IP
change prop­a­gates globally.

Please con­firm if you need a sta­tic IP for the domain, so that we can for­ward
this to the con­cerned department.

Now what part my mes­sage did they not under­stand I did state that I was per­fectly fine with an error mes­sage, that I wanted to use the shared cer­tifi­cate.   I think I implied fairly well that I would pre­fer to use the shared cer­tifi­cate, that way I wouldn’t have to actu­ally buy my own.    This is the prob­lem you get into when you do key­word scan­ning, at least the first guy with bro­ken eng­lish under­stood my ques­tion bet­ter.  My response:

Like I said in my pre­vi­ous e-mail — I do not need a sta­tic IP, nor do I need
a ded­i­cated SSL cer­tifi­cate — I’m fine using the stan­dard shared SSL
cer­tifi­cate — as was/is adver­tised online that all plans came with a shared
server SSL cert — that is what I would like to use and that is what is not
working.

Maybe they’ve finally under­stood my issue?

We are check­ing your query  regard­ing shared SSL in detail. We will get back to
you with the updates soon.

Soon came about thirty min­utes later:

After care­ful review of this ticket, we have decided that you could be bet­ter
assisted in another depart­ment within our company.

For this rea­son, we are trans­fer­ring your ticket. Please expect a short period
of time where this ticket is not updated, as it is queued up at its
destination.

We make every effort pos­si­ble to take care of every ticket as quickly as we
can. We will con­tact you shortly.

Thank you for understanding,

Was was nice enough to leave off the names of their tech­ni­cal sup­port staff.   What I don’t under­stand is why I have to go to another depart­ment — maybe I’m going to the server admins who actu­ally make the changes?  Any time I have an issue it seems that I have to go through a lot of back and forth in the tech­ni­cal sup­port team.   If you techies read my inquiries as unclear, please let me know.   As I get more infor­ma­tion I’ll be updat­ing the comments.

Grrrrrrrrrrrrrr

UPDATE — not often I get to update — it seems HTTPS is now work­ing on my domains — well kind of.   I still have more con­fig­u­ra­tion to com­plete on my side, but it is at least answer­ing now.  Only took thir­teen hours.