SSL issue - connection partially encrypted

[pquesinb]

Hi,

We recently added a signed SSL cert to our site in preparation for going live with the shopping cart. Everything appears to be working, except for the dreaded red padlock in FF and "connection partially encrypted" status for secure checkout/account pages. This appears to be a template issue, but I cannot find where the problem is.

The encryption status is fine on the admin page and is also fine with the default as well as one other template, but the template I want to use, "Red Passion", is causing a problem.

Looking at the page source, there is an image source referencing my site's http://... address instead of https://..., but that reference also exists on the template that works. "View image info" in Firefox shows all https:... image sources; yet telling Firefox to block all images from qsystemsengineering fixes the encryption status so I'm at my wit's end at this point. It's probably a simple fix.

The web store in question is located at qsystemsengineering dot com /shop. Any input would be greatly appreciated.

Thanks!

- Phil

[DrByte]

Seems you've got it fixed.

related tutorial: https://www.zen-cart.com/tutorials/i...hp?article=150

[Website Rob]

There is still the CA Bundle to be installed. Whomever received the Cert (usually in a Zip file) should have also received a file called "gd_bundle.crt" which is required to be installed; by your Hoster.

[pquesinb]

Seems you've got it fixed.

related tutorial: https://www.zen-cart.com/tutorials/i...hp?article=150

Nope, not fixed yet. I did some digging and edited the tpl_header.php file, changing HTTP_SERVER to HTTPS_SERVER as follows:

<div id="headerWrapper">

<!--bof-branding display-->
<div id="logoWrapper">
<div id="logo"><?php echo '<a href="' . HTTP_SERVER . DIR_WS_CATALOG . '">' . zen_image($template->get_template_dir(HEADER_LOGO_IMAGE, DIR_WS_TEMPLATE, $current_page_base,'images'). '/' . HEADER_LOGO_IMAGE, HEADER_ALT_TEXT) . '</a>'; ?></div>
<div id="taglineWrapper">
<?php

Changed to:

<div id="headerWrapper">

<!--bof-branding display-->
<div id="logoWrapper">
<div id="logo"><?php echo '<a href="' . HTTPS_SERVER . DIR_WS_CATALOG . '">' . zen_image($template->get_template_dir(HEADER_LOGO_IMAGE, DIR_WS_TEMPLATE, $current_page_base,'images'). '/' . HEADER_LOGO_IMAGE, HEADER_ALT_TEXT) . '</a>'; ?></div>
<div id="taglineWrapper">
<?php

That took care of the image source referencing the http:... address instead of https:... but still didn't fix the problem when using that template.

As for the gd_bundle.crt file, that's a good point but it must already be installed since the other two templates work fine - showing a blue padlock and blue highlighted bar, high encryption, etc.

Also, as mentioned before, selecting "Block images from www.mydomain.com" in Firefox makes the security error go away, so it doesn't appear to be a certificate issue.

- Phil

[Website Rob]

To clarify my earlier post, I was referring to your site Home page: https:// www.qsystemsengineering . com . If you have an SSL Cert installed for your site then it should work (the same) on any/all parts of your site... and it doesn't appear to.

Your 'shop' dir. does indeed, show the Cert as it should including the "Verified By" information; which is what your site Home page is missing. This indicates there is something odd or wrong related to your SSL Cert install.

[pquesinb]

To clarify my earlier post, I was referring to your site Home page: https:// www.qsystemsengineering . com . If you have an SSL Cert installed for your site then it should work (the same) on any/all parts of your site... and it doesn't appear to.

Your 'shop' dir. does indeed, show the Cert as it should including the "Verified By" information; which is what your site Home page is missing. This indicates there is something odd or wrong related to your SSL Cert install.

Thanks for the info, I finally figured out and just fixed the shop problem about 5 minutes ago. Turns out there was a missing gif file being referenced by that template and asking for that file causes a redirect to the hosting provider's 404 page. I was put on the trail by right-clicking different areas on the web page and selecting "view background image"... that one came up with the 404 page.

As for the home page, there are outside references including StatCounter tracking code, so it doesn't surprise me that it gives the partially encrypted status message.

I'll look into the gd_bundle issue further and contact the hosting provider to see if it hasn't been installed already. I don't think that the certificate would work at all if it wasn't, but I'm certainly no expert in that area so thanks for the heads up.

Thanks to all who tried to help!

Best regards,

- Phil

[DrByte]

I did some digging and edited the tpl_header.php file, changing HTTP_SERVER to HTTPS_SERVER as follows:

<div id="headerWrapper">

<!--bof-branding display-->
<div id="logoWrapper">
<div id="logo"><?php echo '<a href="' . HTTP_SERVER . DIR_WS_CATALOG . '">' . zen_image($template->get_template_dir(HEADER_LOGO_IMAGE, DIR_WS_TEMPLATE, $current_page_base,'images'). '/' . HEADER_LOGO_IMAGE, HEADER_ALT_TEXT) . '</a>'; ?></div>
<div id="taglineWrapper">
<?php

Changed to:

<div id="headerWrapper">

<!--bof-branding display-->
<div id="logoWrapper">
<div id="logo"><?php echo '<a href="' . HTTPS_SERVER . DIR_WS_CATALOG . '">' . zen_image($template->get_template_dir(HEADER_LOGO_IMAGE, DIR_WS_TEMPLATE, $current_page_base,'images'). '/' . HEADER_LOGO_IMAGE, HEADER_ALT_TEXT) . '</a>'; ?></div>
<div id="taglineWrapper">
<?php

That took care of the image source referencing the http:... address instead of https:... but still didn't fix the problem when using that template.

Um, no, that would NOT fix any image problem, because you didn't edit an image. You only edited an A HREF link, which was pointless and unnecessary.

[pquesinb]

Um, no, that would NOT fix any image problem, because you didn't edit an image. You only edited an A HREF link, which was pointless and unnecessary.

That's sort of what I thought, but since my expertise really isn't in web design I wasn't sure... and when I started searching for related material on this site, one of the threads I came across included the following:

While looking at products, my webpage says only partially secured.
I have had two customers complain that they get a popup with every new item regarding displaying secure and unsecure items.
Can I fix this? Or is it that they need to allow cookies, or???

- Firefox in the corner says - Unauthenticated content. with an ! over the lock.

Related FAQ: https://www.zen-cart.com/tutorials/i...hp?article=150

I checked out the tutorial, the only place i have http instead of https
Are my external links. And the image search for skype.

When I tried on IE and told it to not show unsecured items the skype picture was the only thing that changed.

Then that's the first thing to fix.
And then see what happens after that.

Since that was exactly the problem I was having, it seemed like a good place to start. So even if that particular step turned out to be pointless and unnecessary, the advice you gave in that thread still eventually helped to lead me to the right place, so I am grateful for it.

Cheers,

- Phil

[DrByte]

Glad you got it sorted out.