Installed SSL certificate. Not working correctly.

[XYZ500]

My site was accessible as "domain.com".

My host installed the SSL certificate.

I changed the website URL in admin settings from "domain.com" to "https://domain.com".

The site is being accessed as "https://domain.com" but it's not showing that green lock and green 'https' as it should now.

My host says "The SSL is installed and is working without issue however the site pulling over SSL has issues due to non https reference in your site code. This is something you need to consult your developer in regards to."

What do I do to make this work?

[CAG CheechDogg]

You need to check your site for anything that has "http" links in it like images, links, javascripts and external stylesheets ...

In may take some time ...

[kh99]

I haven't done it myself (set up a forum to use https, that is), but I think what they're saying is that your page loads one or more external things via http. So you might have javascript or images that aren't accessed via an https url. I think you should be able to figure that out by viewing the page source of a page and searching for http:, or maybe use the developer tools network tab to see what's being loaded.

It's also a problem if you let people post images. I've seen people handle that by using a proxy for the images, or by copying them to your server. I know there's at least one mod for doing that.

Edit: Like this one: https://vborg.vbsupport.ru/showthread.php?t=253309 . I think there was another one but I can't find it right now.

I was writing while CAG CheechDogg posted, but yeah, that's what I mean.

[CAG CheechDogg]

I was writing while CAG CheechDogg posted, but yeah, that's what I mean.

Thank you kh99 for the extra info ... I forgot to mention that this happens when you let people add images in posts or when you allow people to add signatures and home page links in their profiles.

But yes, one easy way is to right click on the home page and then view "source code" that will give you "some" of the http served images and content to change ...

[XYZ500]

Is the solution to this the same as you two have proposed?

[kh99]

Yes, they're saying the same thing.

[Fields]

I used the following site after I installed a certificate:

https://www.whynopadlock.com/

It tells you which elements aren't called securely.

[XYZ500]

I used the following site after I installed a certificate:

https://www.whynopadlock.com/

It tells you which elements aren't called securely.


@Others

Is the green padlock for every page or the entire site? Meaning, in order to display it green, do I need to correct the URLs on the entire forum or just the particular pages where I want it displayed? I'm asking this so I can do a test. Make sure that all URLs are https on a particular page and see if it shows green then.

But how do I make all external URLs https? For example, on my homepage, in the footer, there is this "User Alert System provided by Advanced User Tagging v3.2.0 (Lite) - vBulletin Mods & Addons" This is a link. The Advanced User Tagging website is not https. So what do I do?

[kh99]

I'm seeing these test results. What does it mean?
I don't know what those results mean. It sounds like it couldn't find any script or image tags on the page. It says it could be that you didn't submit a valid secure link, but it did find your certificate info. I don't know.

Is the green padlock for every page or the entire site? Meaning, in order to display it green, do I need to correct the URLs on the entire forum or just the particular pages where I want it displayed? I'm asking this so I can do a test. Make sure that all URLs are https on a particular page and see if it shows green then.

I'm sure it's per page.


But how do I make all external URLs https? For example, on my homepage, in the footer, there is this "User Alert System provided by Advanced User Tagging v3.2.0 (Lite) - vBulletin Mods & Addons" This is a link. The Advanced User Tagging website is not https. So what do I do?

You don't have to worry about links to other pages, only if it's something that gets loaded on that page, like an image, javascript, or a style sheet.

[XYZ500]

@kh99

After trying to find everything and correcting it, one of the things that I am unable to fix are the last post icons.

These image icons are being loaded with http. Where is the file located that has the links to these icons so I can change them to https?

[kh99]

Hmm...check in the Post Icon Manager and make sure the paths are relative. If they are, I'll have to dig deeper to find out where it's getting the http.

[kh99]

Oh, check the imgdir_misc stylevar (which is in the ImagePaths section).

[XYZ500]

Oh, check the imgdir_misc stylevar (which is in the ImagePaths section).

imgdir_misc is showing the path images/styles/THEMENAME/misc

Nothing here that needs to be fixed, I think.

Checked Post Icon Manager too. And edited the links from http to https. Still padlock is not green.

[CAG CheechDogg]

How about a link to your site ... i can take a look and we can go from there ....

[CAG CheechDogg]

Another reason and probably the actual reason you don't have the green lock is because you don't have all of the following requirments:



- SSL Certificate is not expired
- Site is listed in the certificate
- Organisation details are not listed
- Encryption strength is below 2048-bit
- Signature Algorithm is strong
- Accepting only high encryption cipher suites
- No connection upgrade to 128-bit for old browsers
- No Extended Validation on company details
- No Debian weak key present
- No known security issues for this Certificate Authority


The ones highlighted are needed for the green lock to display all the time as well on top of not having any http served content on your site. You don't have a full ssl certificate which has your company details you only have a basic one just like I do which is why you don't have the green lock.

[XYZ500]

I looked for these post icons in the Post Icon Manager. Found the links. I changed the http to https. Nothing happened. When I went back to the forum and looked into the elements, they were still showing as http and not https (even when they had been changed to https in the Post Icon Manager). So then I deleted all the icons from the Post Icon Manager. Technically, this should have stopped displaying the post icons on the forum but it didn't. The URLs were still there, intact. This leads me to believe that these links are somewhere else. I tried searching for the URLs in all the templates, style variable editor and language and phrases manager. Didn't find the URLs. I'm not sure how else I can search for it. If it's in the website files, I don't know which one to look for.

Can someone help?

[fxdigi-cash]

The problem is that you are on a shared host, otherwise, it is very likely to know what the issue is...

ok, so you are saying that the icons on your website show up only when the url request is HTTP not HTTPS?

if this is the case, then you need to edit the root to your forum adding https instead of http

you can post your website link to see what's going on!! or you can PM it to me to check it if you like,

[XYZ500]

The problem is that you are on a shared host, otherwise, it is very likely to know what the issue is...

ok, so you are saying that the icons on your website show up only when the url request is HTTP not HTTPS?

if this is the case, then you need to edit the root to your forum adding https instead of http

you can post your website link to see what's going on!! or you can PM it to me to check it if you like,

"ok, so you are saying that the icons on your website show up only when the url request is HTTP not HTTPS?"
No, the icons are displayed regardless of how the URL is requested. What I'm saying is that I think the https on the URL bar is not green (as it should be after I installed SSL) because the links are loaded as http. I need to edit the links so they are loaded as https.


I think I might have figured it out. The post icon's links are in the SQL database. I know this because I ran a search of the post icon link in the SSH and it found the link in all the SQL database backups I have of my forum on the server.

Is there a way to edit them in the SQL database and replace the http with https in the links?

P.S. I'm on a dedicated server.

[XYZ500]

The problem has been solved.

This thread can be locked now.