I have prepared my multisite configuration in D6.
E.g. www.example.com, site1.example.com, site2.example.com
I used shared particular db tables as recommended in many forum topics.
$cookie_domain = '.example.com';
, $base_url
not set
Due to some reasons I have just one SSL certificate issued to www.example.com
Login form on each site post data to www.example.com and after authentication the user is redirected back. None of "Secure Login", "Secure pages",... modules satisfy me with the functionality to redirect user back to page from which he/she logged in. Finally I used just apache2 mod_rewrite to force HTTPS on "user" and "admin" pages and module Actions to redirect back.. Everything's fine.
Drupal7 incorporated enhanced security to prevent session hijacking. The result is that whenever user switches between http/https he/she lost authenticated session. I even tried to use $conf['https'] = TRUE;
in settings.php for each site but nothing changed.
1. How to use properly $conf['https'] = TRUE;
? I put it to every settings.php for each site [I have no setting.php in sites/default/]
2. Or how to solve my setup completely different way? Try to keep "one SSL cert" solution without the hurting users about different web address and host in certificate.