The site uses SSL, but Google Chrome has detected

Question

I'm using SSL on my website and it is giving me the lock with yellow triangle icon ("The site uses SSL, but Google Chrome has detected insecure content on the page.")

On clicking the lock icon it says:

Your connection to domainname is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the look of the page. The connection uses TLS 1.0. The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism. The connection is not compressed.

How do I ensure I get the green lock?

Answer 1

This is what I get when I go to TOOLS and then click on JAVASCRIPT CONSOLE ::

Failed to load resource chrome://thumb/https://accounts.google.com/ServiceLogin?service=chromiumsyn...
    s%3A%2F%2Fwww.google.com%2Fintl%2Fen-US%2Fchrome%2Fblank.html%3Fsource%3D1
Failed to load resource chrome://thumb/http://www.xe.com/

What do I do after this?

Answer 2

I had the same problem and it occoured because I included a script from Google Analytics using HTTP.

With a provider like Google, one can simply change HTTP to HTTPS - and it will work. This will not work with all providers.

If you are trying to load something from a website that you own, you will have to secure that website with HTTPS.

---

Google Chrome will detect this and automatically not load the insecure content (from the HTTP domain) which may take away some functionality from the website.

Certain AV/Malware softwares will also detect this and give a security warning which may frighten your visitors away.

If you are using Google Chrome, then you might not notice such a warning, because the AV/Malware software never sees this HTTP-link because it is blocked by Google Chrome.

And if you do not have the kind of AV/Malware software that detects this then you may never notice such a warning while the visitors are.

---

What you must do is:

• Install Google Chrome and go to the website.
• Click on "Tools >> JavaScript Console" and see if any warning appears. (this has been commented by Brad Koch on the question as well)
• Go throught the different pages on your website and see if any errors appear - if so, then go change the URLs to HTTPS (if this is possible) or find another provider for this javascript.

Answer 3

You must have resources (images, stylesheets, scripts, etc...) which are embedded on the page but are not served over https. Make sure all your resources are served over https, and that warning should go away.

Answer 4

make sure all references to resources such as images, js files, css files, ads, etc are served through https. If the uri to the resource is relative, e.g. /images/logo.png, then the resource is fetched from the same host and port and protocol as the page itself, in your case https. I would use fiddler to find what files get fetched over http:// when the page is loaded.