SSL and the open lock

[Mushroom]

I'm missing something about this operation.
In configure I have HTTPS server defined, and I have my own SSL cert.
THe 'error' I get is on the pages we go to HTTPS ( account and order stuff ) the lock does appear and the page goes to https. However in IE the lock is closed and in FireFox ( and Safari ) the lock is OPENED and when one clicks on it the error is that '' Parts of the page you are viewing were not encrypted before being transmitted over the Internet.''

This has already scared one customer away because he felt it wasn't safe to enter his credit card.

Any clues, or is that just the way it is?

[michael_s]

You have some javascript or img src tags that are being called via non-ssl urls. This is a common problem with people new to osC and osCMax. They hardcode the urls to their images or javascript with a url like:

http://somesite.com/some/path/image.gif

when they need to code it like:

/some/path/image.gif

dropping the http://somesite.com part, as osCMax automatically will fill that in with the correct http or https...

Post a like to your site...

[Mushroom]

Try this I have three outside links, each is referenced with HTTPS (google, cslivehelp, and Comodo [the ssl cert]) I have commented each of them out to no avail. Currently I have configure.php set up with HTTPS as the only target ( I made this change 10 mins ago. ) I looked through application_top and _botton and columns left and right. I also looked through the source of a page. Each reference is either a relative link or https: .
Got me.

[michael_s]

Check your stylesheet. Are you loading background image with a full url?

[Mushroom]

That is background-image: url(/catalog/images/waxfound.gif);
I'll let you read it, I'm not great at this. I'm open to any ideas.

On Edit: And to prove it to myself I deleted the background entries from the css. No joy.

[michael_s]

Strange...

What happens when you switch to a different template?

[michael_s]

I pulled the headers being served and it looks like something is 404 on the page, as it is pulling the 404 error page via http.

Check your error logs for what is 404 and fix that.

https://www.dianeshoney.com/catalog/stylesheet.css

GET /catalog/stylesheet.css HTTP/1.1
Host: Dianes Honey and Beeswax Candles : 100% Pure Beeswax Candles - Free Ground Shipping over $100
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: https://www.dianeshoney.com/catalog/...?my_account_f=
Cookie: osCsid=cdd5de9d62f274d07b8f4105fcf9225a; cslhVISITOR=c74a64440ffd092909933b41db69f73a; cookieid=60a9be86702b2e40c1e57f116c338db1; __utma=256322334.85680467.1168311290.1168311290.11 68314818.2; __utmc=256322334; __utmz=256322334.1168314818.2.2.utmccn=(referral)| utmcsr=oscmax.com|utmcct=/forums/oscmax-v2-installation-issues/6841-ssl-open-lock.html|utmcmd=referral; __utmb=256322334
Cache-Control: max-age=0

HTTP/1.x 302 Found
Date: Tue, 09 Jan 2007 03:54:30 GMT
Server: Apache
Location: http://www.dianeshoney.com/404.html
Content-Length: 289
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
----------------------------------------------------------
http://www.dianeshoney.com/404.html

GET /404.html HTTP/1.1
Host: Dianes Honey and Beeswax Candles : 100% Pure Beeswax Candles - Free Ground Shipping over $100
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: cslhVISITOR=c74a64440ffd092909933b41db69f73a; cookieid=60a9be86702b2e40c1e57f116c338db1; __utma=256322334.85680467.1168311290.1168311290.11 68314818.2; __utmc=256322334; __utmz=256322334.1168314818.2.2.utmccn=(referral)| utmcsr=oscmax.com|utmcct=/forums/oscmax-v2-installation-issues/6841-ssl-open-lock.html|utmcmd=referral; __utmb=256322334
If-Modified-Since: Sun, 31 Dec 2006 23:03:40 GMT
If-None-Match: "ac84ff-16b-81fb0b00"
Cache-Control: max-age=0

HTTP/1.x 304 Not Modified
Date: Tue, 09 Jan 2007 03:54:30 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
Etag: "ac84ff-16b-81fb0b00"

[Mushroom]

And we have a WINNER !

My host, like many others has the option to design your own 404 page. It is directed in .htaccess I just had to specify https:
Thanks for digging. It was quite painful.

On Edit: The 404 was being called up because SOMETHING is trying to look at /catalog for the stylesheet rather than in the template. Since I only use one template it's not a big deal to work around. One day I will see what mod is causing this.