Check the source of the page for any external objects (scripts, stylesheets, images, objects) linked using http://...
rather than https://...
or a relative path. Change the links to use relative paths, or absolute paths without protocol, i.e. href="/path/to/file"
.
If all that if fine, it could be something included from Javascript. For example, the Google Analytics code uses document.write
to add a new script to the page, but it has code to check for HTTPS in case the calling page is secure:
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>