30

Visiting my site in SSL and in Chrome (12.0) I get

Your connection to someWebsite is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the behaviour of the page.

The connection uses TLS 1.0.

The connection is encrypted using AES-256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism.

The connection is compressed with DEFLATE.

I searched with FireBug (NET tab) and Chrome Inspector and all resources are accessed via https. Where is the problem? *I cleared the cache already

What could be the problem?

1
  • 2
    Do you have some javascript that's loading resources of its own? (Not sure if Firebug or Chrome Inspector would pick that up anyway). Could try loading Fiddler and seeing what requests are actually going out.
    – Paolo
    Jun 24, 2011 at 8:33

6 Answers 6

28

Chrome will give this error if you've visited another https page on the same domain that had mixed content however this should not be the problem if you've tried clearing your cache.

1
  • 2
    Just for completeness, one clears the cache by hitting the "Wrench icon" => Tools => Clear browsing data ... (at least on the Mac) Jun 5, 2012 at 14:56
21

You might want to try Ctrl-Shift-J for the JavaScript console, it should show the insecure content.

0
3

I have the same thing - and I read from the Google Chrome help site that elements on the site are not encrypted - like videos. I looked via Firefox - right click->View Page Info->Media tab and saw that every time I use a YouTube video in my video player I have plain http addresses like:

http://s.ytimg.com/yt/swfbin/watch_as3-vflrEm9Nq.swf and http://img.youtube.com/vi/V6JgyNy59yA/1.jpg

I think these non https links are causing the security message site-wide. Thus, it appears using videos from 3rd party sites will always throw a security error in Google Chrome for https pages.

That's my answer - but I have no solution yet. I need to be able to share videos from youTube in our news section, but my online store section needs to use https without scary red letters and slashes through it for my clients.

Has anyone dealt with this effectively?

Thanks

2

Had the same problem on my Magento Site. Be sure to change all image and js links (even in .css) from http:// to simply //. Solved it for me.

1
  • 2
    I wasn't aware you you can use relative URLs starting with //. I is true an supported by all browsers?
    – sorin
    Jul 20, 2012 at 7:29
0

I had the same issue, my problem was that some img tags had src to http instead of https, it does not matter even they link to other domain like <img src="http://otherdomain.com/image.jpg" /> it still shows that warning. As soon as I changed all internal and external img links to https the warning disappeared.

0

If you check the page and it seems to have no insecure content, check to make sure that something on the page is not submitting data to an insecure location. Content should be submitted over HTTPS, not HTTP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.