Install Sana Webstore on Web and Database Server

Secure Your Web Store with HTTPS

 NOTE

Starting from Sana 9.2.1, the Sana Commerce Installer provides a possibility to install Sana with the SSL certificate right away, so the entire Sana Commerce solution, both Sana web store and Sana Admin, will run over HTTPS. If you installed Sana with the SSL certificate, you can skip this step.

HTTPS (Hypertext Transfer Protocol Secure) is an internet communication protocol that protects the integrity and confidentiality of data between the user's computer and the website. Users expect a secure and private online experience when using a website. You must set up HTTPS in order to protect your users' connection to a Sana web store.

 NOTE

The Web server which hosts the Sana web store must support TLS 1.2.

 NOTE

Before configuring HTTPS, you must obtain a security certificate for the domain of your Sana web store. The certificate is issued by a certificate authority (CA), which takes steps to verify that your web address actually belongs to your organization. In case of a multistore solution and depending on your setup, you might need an additional certificate for each web store domain.

If this is a test environment, you can create and use a self-signed SSL certificate. The self-signed SSL certificate can be used only for testing purposes.

Configure Internet Information Services (IIS) Manager to listen to HTTPS

Step 1: Open IIS Manager.

Step 2: In the IIS Manager select the web site where Sana Commerce is running.

Step 3: In the Actions pane on the right click Bindings.

Step 4: In the Site Bindings window click Add.

Step 5: Add site binding with the https type and select previously created self-signed SSL certificate or obtained from a certification authority:

 NOTE

By configuring full HTTPS, Sana web store and Sana Admin will run via HTTPS.

Step 1: Open the 'Web.config' file of the Sana Commerce Frontend.

Step 2: Locate the following line:

<ssl mode="Off" partialConfigPath="partial-ssl.config" bypassWarning="true" />

Step 3: Change SSL mode to 'Full'.

With the 'Full' SSL mode the web store completely runs via HTTPS, and all requests to HTTP will be automatically redirected to HTTPS.