Hello
you should consult your logs and open a console in your browser to see the resquests and the answers

do you have a link to http and https server ?

Mark O'Shea wrote:

Can also give you admin access if that would help.

I cannot register because the captcha does not work for the same reason...

on admin home page, click show info and copy/paste the "Apache Environment" (make sure you remove cookies and other private stuff)

That's interesting. The captcha works on HTTP but not HTTPS.

Here is the Apache Environment section:

Variable    Value
HTTP_HOST    www.x.co.uk
HTTP_CONNECTION    keep-alive
HTTP_ACCEPT    text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
HTTP_USER_AGENT    Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
HTTP_REFERER    https://www.x.co.uk/admin.php
HTTP_ACCEPT_ENCODING    gzip,deflate,sdch
HTTP_ACCEPT_LANGUAGE    en-GB,en-US;q=0.8,en;q=0.6
HTTP_COOKIE    side-info=visible; pwg_id=7upvrqeehq43t3kar1tjquk6c6; page-menu=visible
PATH    /usr/local/bin:/usr/bin:/bin
SERVER_SIGNATURE    <address>Apache/2.2.16 (Debian) Server at www.x.co.uk Port 80</address>
SERVER_SOFTWARE    Apache/2.2.16 (Debian)
SERVER_NAME    www.x.co.uk
SERVER_ADDR    10.1.1.5
SERVER_PORT    80
REMOTE_ADDR    158.230.x.x
DOCUMENT_ROOT    /var/www/gallery
SERVER_ADMIN    [no address given]
SCRIPT_FILENAME    /var/www/gallery/admin.php
REMOTE_PORT    11954
GATEWAY_INTERFACE    CGI/1.1
SERVER_PROTOCOL    HTTP/1.1
REQUEST_METHOD    GET
QUERY_STRING    action=phpinfo
REQUEST_URI    /admin.php?action=phpinfo
SCRIPT_NAME    /admin.php

Let me know if you want to see any more.

I actually got the config from the server when logged in via https so I think you are spot on with your thoughts about Piwigo not knowing that it's running as secure. 

As far as I know I'm not running a reverse proxy. I have a firewall that just forwards requests to the relevant web server inside the local network.

Piwigo shares it's server with Horde and that software preconfigured the https server when it was installed. To get to Piwigo I just set up a new virtual host to accept the relevant https requests and configured the firewall to send the requests to the right server. The virtual host configuration on the server that hosts Piwigo was done with Webmin.

I get the feeling now that there is more to configuring a secure server than what I have actually done. What confused me is that most things worked okay. Looks like the Captcha and Batch Manager don't like what I've done. Any idea why these are the only obvious issues?

Last edited by Mark O'Shea (2014-01-21 19:26:00)

I've finally managed to fix the problem but have been left feeling slightly embarrassed.

My problems were caused by 'someone' forgetting to include the directives that actually turn on the SSL engine and register the keys for the virtual server.  Yes, you guessed it right, that person was me!

This is what I left out from /etc/apache2/apache2.conf at the bottom of the virtual server configuration section:

SSLEngine on
SSLCertificateFile /etc/ssl/localcerts/apache.pem
SSLCertificateKeyFile /etc/ssl/localcerts/apache.key

In Webmin this is configured in the SSL options menu for the virtual server.

It looks so obvious now, I just don't know how I missed it.

It's great to have my server finally working properly. I can now indulge in my latest past-time of generating batches of multiple sized images when logged in with SSL encryption ;-)

I really appreciate all the help I've had with this. I'm another delighted Piwigo user.

Cheers
Mark