Users discover strange browser behavior by clicking on favicon

Hi guys! We're running 1.3.9h i think.

Users told me they get SSL warnings by clicking on the favicon in the address bar of the browser.

This is surprising because I never in my life thought to click on the favicon in the browser. But the users say they can reproduce this error across multiple platforms like Mac and Window$.

I've assigned this issue a low-priority but it's one of those things that's really curious in terms of browser behavior. I know it's an outdated term but we used to describe such things in terms of a "modal shift" rather than "user state" and certainly it's outside what we'd normally think of as SSL protection because, and dig this, OUR FRONT END IS JOOMLA! USERS DON'T EVEN ENTER SSL UNTIL THEY CROSS OVER INTO ZENCART AND ENGAGE SSL IN CHECKOUT!

I'm an old guy on a linux system. I'm unaware of what the new, hip M$ browsers and trendy handheld devices are doing with user modality. Could some of you young, hip and good-looking youngsters weigh in?

Yeah, waste of all our time but just to reassure myself that I'm not loosing my memory because I'm a farty old guy, favicon still isn't part of official HTML or XHTML spec, and what spec there is indicates NO FUNCTIONAL BEHAVIOR from favicon, it's just a stupid icon.

1. It should still show up on a linux system, provided you are using a vaguely modern browser, normally when you go to an ssl page where there is a problem with the ssl, either
   a) a warning will pop-up
   b) The little lock symbol will appear unlocked
   c) the colour of the address doo-hickey wont turn blue or green (depending on the level of ssl protection paid for)

2. It is important to check out (provide us a link if you can), the most common are the page pulling in insecure resources
   eg an image with the src link of (http://yoursite/noddle.jpg) on a secure page will throw an error should be (https:// blah blah) or just a relative link

There are other reasons, but until you click on the favicon in the address bar you won't know

88888888888888888888888888888888

EDIT

Iget an expired certificate error, will pm you the details obviously

You are correct! There is a problem with the SSL cert on this site.

The ISP says we have renewed our cert and everything is fine. They are currently issuing something called an "Alpha SSL" cert. My theory now is that this cert is not from a "well known and trusted domain" which is ARBITRARILY added into browsers by the browser writers.

My theory is if we get a "trusted cert" from Authnet or somebody, users won't get the "add exception" notice from IE.

So far it seems we only get warnings from IE users, although I have one report of this from a Safari user.

Favicons get you a few SEO points these days. With multi-tab browsing now the norm, the SE's reward sites that enable people to quickly recognise a tab, making their browsing more organised and easier.

Well this one near about drove me crazy, the client beat me relentlessly like I'm a rented mule but here's how it resolved.

The client did in fact pay to have their SSL cert renewed BUT they failed to reply to a confirmation email sent to [email protected] and nobody at this client was configured to receive this email or they just plain ignored it so the cert continued to flash expired messages to users.

The reason I didn't see it is because I added a security exception when I build the stupid site.

Sales on this site have been taking a massive beating and now we understand why.

I think I'll strap on my hunting knife and kill something furry and soft and innocent. Killing my client in sheer frustration would be pretty counter-productive.:lamo::no: