[users@httpd] SSL & nonsecure items

["Warhurst, SI (Spencer)" <S....@rl.ac.uk>]

I'm currently wrestling with the set up of SSL on Apache (on Windows) and I have the server up and running and accepting https connections etc. When I first connect to the website from my browser (IE in this case) I get the warning regarding the certificate (I have set up a test certificate), which is fine. However every page I subsequently go to I get a "do you want to display nonsecure items" dialog and it's quite irritating. I suspect a browser setting is partly to blame, except I don't get the message when I go to other sites with https implementations such as Amazon. I presume the nonsecure items are the images on the page, but Amazon has images too. SO is there something in the SSL config that might cause the browser to generate these messages?

--
Spencer Warhurst

Re: [users@httpd] SSL & nonsecure items

["S.Hayles" <sh...@leicester.ac.uk>]

On Wed, 26 Apr 2006, Warhurst, SI (Spencer) wrote:

> I'm currently wrestling with the set up of SSL on Apache (on Windows) and I have the server up and running and accepting https connections etc. When I first connect to the website from my browser (IE in this case) I get the warning regarding the certificate (I have set up a test certificate), which is fine. However every page I subsequently go to I get a "do you want to display nonsecure items" dialog and it's quite irritating. I suspect a browser setting is partly to blame, except I don't get the message when I go to other sites with https implementations such as Amazon. I presume the nonsecure items are the images on the page, but Amazon has images too. SO is there something in the SSL config that might cause the browser to generate these messages?

I suspect the problem is that the page contains non-secure URLs to such 
things as images and style sheets that are loaded by the browser in order 
to render the page.

If your page is https://www.domain.ac.uk/index.html and it contains
<img src='http://www.domain.ac.uk/image.jpg'>
you'll get the warning.

If it contains
<img src='/image.jpg'>
or
<img src='https://www.domain.ac.uk/image.jpg'>
then you won't.

Steven

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org