HTTPS green bar loads then goes away

Question

I have properly configured SSL, and it loads pages when you put HTTPS. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The URL stays as HTTPS. I have checked all items on the page for any NON-HTTPS items and I couldn't find any.

The site URL is: www.jlucina.com.

Why does the bar turn green then go away after the page fully loads?

UPDATE: It seems to work on Chrome for the most part. If I continue shopping and add another item it breaks. So weird.

I have confirmed that it is a mixed content issue because I used a plugin that disables all images on the site and it stays green when I do that. I can't find which image is causing the issue.

Answer 1

The problem is that you sometimes refer to https resources by https://jlucina.com; for example one image is located at: https://jlucina.com/sites/default/files/pin.png

Now your web site is setup that https://jlucina.com 301 redirects to http://www.jlucina.com, so despite the https in the source the resource is sent unencrypted over the network, so you get the partially encrypted warning in firefox. So if you try going to https://jlucina.com/sites/default/files/pin.png you end up at http://www.jlucina.com/sites/default/files/pin.png which is your mystery unencrypted media resource.

You can use curl to see the http response headers:

$ curl -I https://jlucina.com/sites/default/files/pin.png
HTTP/1.1 301 Moved Permanently
Date: Thu, 23 Aug 2012 10:15:05 GMT
Server: Apache
Location: http://www.jlucina.com/sites/default/files/pin.png
Cache-Control: max-age=1209600
Expires: Thu, 06 Sep 2012 10:15:05 GMT
Connection: close
Content-Type: text/html; charset=iso-8859-1

I got to the bottom of this by using a tool like firefox's web console, seeing what's sent over the network on port 80 (facebook.png, twitter.png, pin.png) and then going back to the page, seeing how/where they were referenced and eventually figuring out https://jlucina.com differed from other https links and used curl to check the headers of the request.