Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have properly configured SSL, and it loads pages when you put HTTPS. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The URL stays as HTTPS. I have checked all items on the page for any NON-HTTPS items and I couldn't find any.

The site URL is:

Why does the bar turn green then go away after the page fully loads?

UPDATE: It seems to work on Chrome for the most part. If I continue shopping and add another item it breaks. So weird.

I have confirmed that it is a mixed content issue because I used a plugin that disables all images on the site and it stays green when I do that. I can't find which image is causing the issue.

share|improve this question
What browser are you observing this in? – B-Con Aug 23 '12 at 16:15
Firefox at the moment. Haven't gotten around to cross browser testing it yet. – Digital Fire Aug 23 '12 at 16:18
Perhaps mixed content – CodesInChaos Aug 23 '12 at 16:22
Yes, I'm checking for that but can't find WHAT is the item that is non-https. Do url targets count? – Digital Fire Aug 23 '12 at 16:23
If I try I get a 302 redirect to HTTP/1.1 302 Found ... Location: – dr jimbob Aug 23 '12 at 16:24
up vote 12 down vote accepted

The problem is that you sometimes refer to https resources by; for example one image is located at:

Now your web site is setup that 301 redirects to, so despite the https in the source the resource is sent unencrypted over the network, so you get the partially encrypted warning in firefox. So if you try going to you end up at which is your mystery unencrypted media resource.

You can use curl to see the http response headers:

$ curl -I
HTTP/1.1 301 Moved Permanently
Date: Thu, 23 Aug 2012 10:15:05 GMT
Server: Apache
Cache-Control: max-age=1209600
Expires: Thu, 06 Sep 2012 10:15:05 GMT
Connection: close
Content-Type: text/html; charset=iso-8859-1

I got to the bottom of this by using a tool like firefox's web console, seeing what's sent over the network on port 80 (facebook.png, twitter.png, pin.png) and then going back to the page, seeing how/where they were referenced and eventually figuring out differed from other https links and used curl to check the headers of the request.

share|improve this answer
+1 for the answer and if curl/wget and strace fail there's always tcpdump/wireshark to figure out what the clients and servers are actually saying to each other (up to a point) – adric Aug 23 '12 at 19:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.