SSL: Why does Chrome report mixed content? (Drupal 6)

Question

I've just got a site running nicely with the whole site running through SSL, but Google Chrome is throwing a "This page contains some insecure elements" message, which isn't good in terms of end user trust-ability. All other browsers work fine, and give the golden padlock.

The site is a Drupal 6 e-commerce site, running on apache2, and the error appears in the front end as well as the admin area.

Does anyone know of any methods to find out exactly which elements are being considered insecure?

Edit: I've used Fiddler to check the traffic, and it really is all HTTPS. It even complains on the site holding page, which is very light and has no javascript etc on it...

Answer 1

Search the source for http:? Something like <Ctrl-U> <Ctrl-F> http: in firefox should do.

The insecure element is something loaded over insecure — non-https — connection, e.g. image, stylesheet, etc. you obviously need fully qualified URL to load insecure element/

Answer 2

Use Firebug plugin of Firefox. In the NET tab all file locations are shown clearly. Try to find any files that are obtained from http protocol.

Answer 3

It could be a browser issue? Have you tried restarting, or clearing all of your cache?

Answer 4

In Chrome, this is trivial. Hit CTRL+SHIFT+J to open the developer tools, and it will plainly list the URL of the insecure content.

Try it on https://www.fiddler2.com/test/securepageinsecureimage.htm, for instance.

Answer 5

FYI, I'm having the same issue with Drupal 6 and Ubercart 2.0. Everything you're saying is also applicable to my situation, and I can't figure it out for the life of me. I don't think this should come into play, but any chance you use ipsCA as your certificate provider?

Did you ever find a solution?

Answer 6

It's probably related to this bug:

http://code.google.com/p/chromium/issues/detail?id=24152

Which is why a restart fixed it.