0

I'm attempting to fully verify the HTTPS encryption using Chrome & Firefox but both browsers currently display the connection as 'including resources which are not secure'.

I have tried using WireShark to package sniff the wire, but I am unable to determine what is causing this http request, because WireShark detects no traffic as HTTP on the main page.

Here is my .htaccess file for the root domain https://diginomics.com:

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://diginomics.com/$1 [R,L]

Notice how some pages such as /about are verified, but the main page is not? Why is this? There must be something simple that needs adjustment.

Also, the HTTPS redirect completely overruled by subdomain which should be on forum.diginomics.com

Good people of Stack Information Security, how can I find where the insecure content is coming from when I am packet sniffing and nothing on the main page comes up as HTTP? What is causing the breach in security on the main page but not on the others?

Improve this question
3
  • maybe you need to confirm the filter you used for your packet capture - are you linking to content outside of your domain? Fonts?
    – schroeder ♦
    Apr 13, 2015 at 2:41
  • The filter I am using for WireShark is simply 'http'. That seems to work well enough. Does a TLS encryption need all incoming AND outgoing connections to be HTTPS? For example, if I am linking to a font on google.com/fonts, will it compromise the authenticity?
    – Travis Patron
    Apr 13, 2015 at 3:25
  • You better check at the browsers console for this kind of problems instead of wireshark. Look out for messages about blocked resources because of mixed content.
    – Steffen Ullrich
    Apr 13, 2015 at 4:35

1 Answer 1

Reset to default
2

The reason you're getting this is because you load certain resources over HTTP. When you look at the page source code, you'll see this:

<link rel='stylesheet' id='google-font-body-css'  href='http://fonts.googleapis.com/css?family=Open+Sans+Condensed&#038;ver=4.1.1' type='text/css' media='all' />
<link rel='stylesheet' id='google-font-heading-css'  href='http://fonts.googleapis.com/css?family=Abel%3A300%2C500%2C600&#038;ver=4.1.1' type='text/css' media='all' />
<link rel='stylesheet' id='google-font-third-css'  href='http://fonts.googleapis.com/css?family=Indie+Flower&#038;ver=4.1.1' type='text/css' media='all' />

Meaning that your fonts are loaded over HTTP (possibly there are more resources that are loaded over HTTP rather than HTTPS)

In order to solve this problem, you could use the following code:

 <link rel='stylesheet' id='google-font-third-css'  href="//fonts.googleapis.com/css....">

This means that the resources are loaded over HTTP(s) if the page is loaded over HTTP(s)

Hope this helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .