8

I'm using SSL on my website and it is giving me the lock with yellow triangle icon ("The site uses SSL, but Google Chrome has detected insecure content on the page.")

On clicking the lock icon it says:

Your connection to domainname is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the look of the page. The connection uses TLS 1.0. The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism. The connection is not compressed.

How do I ensure I get the green lock?

1
  • 3
    In Chrome, the developer console should list the items fetched over an insecure connection as warnings - "The page at [domain] displayed insecure content from [location]".
    – Brad Koch
    Oct 15, 2012 at 19:09

4 Answers 4

15

You must have resources (images, stylesheets, scripts, etc...) which are embedded on the page but are not served over https. Make sure all your resources are served over https, and that warning should go away.

3
  • 1
    how do you do this? is this line in production.rb enough config.force_ssl = true if you have youtube and soundcloud embeds
    – Jaqx
    Apr 11, 2013 at 23:07
  • @ayounesi it's easy enough to find out - set it that way any open up your browser source and see how they are output. Apr 12, 2013 at 0:20
  • The page that's being loaded loads just fine itself over https (so I know there aren't images, stylesheets, etc. that are breaking ssl in the iframe'd content), but I'm still getting the error from Chrome (and Firefox as well) that the iframe'd content is insecure. Sep 14, 2015 at 19:24
3

I had the same problem and it occoured because I included a script from Google Analytics using HTTP.

With a provider like Google, one can simply change HTTP to HTTPS - and it will work. This will not work with all providers.

If you are trying to load something from a website that you own, you will have to secure that website with HTTPS.


Google Chrome will detect this and automatically not load the insecure content (from the HTTP domain) which may take away some functionality from the website.

Certain AV/Malware softwares will also detect this and give a security warning which may frighten your visitors away.

If you are using Google Chrome, then you might not notice such a warning, because the AV/Malware software never sees this HTTP-link because it is blocked by Google Chrome.

And if you do not have the kind of AV/Malware software that detects this then you may never notice such a warning while the visitors are.


What you must do is:

  • Install Google Chrome and go to the website.
  • Click on "Tools >> JavaScript Console" and see if any warning appears. (this has been commented by Brad Koch on the question as well)
  • Go throught the different pages on your website and see if any errors appear - if so, then go change the URLs to HTTPS (if this is possible) or find another provider for this javascript.
1
  • Thanks a lot. After seeing this solution my issue solved. Ur suggestion of Tools>>JS Console helped me.. May 2, 2014 at 13:07
1

make sure all references to resources such as images, js files, css files, ads, etc are served through https. If the uri to the resource is relative, e.g. /images/logo.png, then the resource is fetched from the same host and port and protocol as the page itself, in your case https. I would use fiddler to find what files get fetched over http:// when the page is loaded.

-1

This is what I get when I go to TOOLS and then click on JAVASCRIPT CONSOLE ::

Failed to load resource chrome://thumb/https://accounts.google.com/ServiceLogin?service=chromiumsyn...
    s%3A%2F%2Fwww.google.com%2Fintl%2Fen-US%2Fchrome%2Fblank.html%3Fsource%3D1
Failed to load resource chrome://thumb/http://www.xe.com/

What do I do after this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.