SSL Warning Message

[Atomic]

I have an up to date SSL Certificate and have SSL checked on the Whole Site option in Business Settings.
My SSL providers verification icon confirms that my certificate is active and my web host also confirms that the SSL package i have is set up correctly on their server.

I've noticed that when on the cart and checkout pages the "padlock" icon is showing the warning message "Contains unauthenticated content" which is obviously a major put off to any potential customers. This has only just come to my attention and I have no idea how long it's been happening.

My web host has advised that: "The issue probably lies in your ecommerce application. It is possible that there may be links on the scripts that are unsecured."

I'm not entirely convinced by my hosts ascertion that it's a problem with Actinic but if it is, does anyone know how to cure it?

[Duncan Rounding]

An example URL would help.
The cause if often an image or javascript that is loaded from a non secure location.

[Atomic]

Thanks

You can go to this page and click to buy any of the products
http://www.blackironmongery.co.uk/ac...ee_hinges.html

[Duncan Rounding]

The base ref is wrong on the checkout (SSL) pages:
<base href="http://www.blackironmongery.co.uk/acatalog/"/>
should be:
<base href="https://www.blackironmongery.co.uk/acatalog/"/>

Check the Actinic BaseHref tag in your outer layout.

[fergusw]

Stephen,
This error is simply because there are images on the page that are being called/loaded from a non-secure (http://) location instead of a secure (https://) location.
I'd check your basehref field in Actinic. It is forcing all the images (bar the geortrust icon) to come from http:// instead of https://. I'd suggest that it has been hard-coded into the overall layouts on your site, however it's best to double-check.
You'll also need to change the geotrust icon reference as well - there are a few posts in the community forum that show the conditions you'll need to put into your overall layout that will resolve this as well.

[NormanRouxel]

Techy explanation of what's wrong: When your site switches to https the BASE HREF in your pages head area doesn't. Thus images are being loaded from the insecure site.

I'm afraid that I don't know why this is happening.

Posting your Network settings (hide passwords) might be a useful next step.

[Atomic]

I thought it might have been something to do with that but I'm unsure where I need to go to change it.

In the advanced web settings both the catalog url and the cgi-bin url are https://

If I go into the BaseHref layout code in design it displays the following and I can't find where it's getting the info for the variables other than from the above

<actinic:block if>
<actinic:block if>
<Actinic:BASEHREF VALUE="<Actinic:Variable Name="CatalogURL"/>" FORCED=0 />
</actinic:block>
<actinic:block if>
<Actinic:BASEHREF VALUE="<actinic:variable name="CatalogHomeURL" />" FORCED=1 />
</actinic:block>
</actinic:block>
<actinic:block if>
<actinic:block if>
<Actinic:BASEHREF VALUE="<Actinic:Variable Name="SSLCatalogURL"/>" FORCED=0 />
</actinic:block>
<actinic:block if>
<Actinic:BASEHREF VALUE="<actinic:variable name="SSLCatalogHomeURL" />" FORCED=1 />
</actinic:block>
</actinic:block>

[fergusw]

Is that a 100% true copy/paste from your Default Base Href layout?
Normally it should look like

<actinic:block if="%3cactinic%3avariable%20name%3d%22IsBaseHREFStandard%22%20%2f%3e">
   <actinic:block if="%3cactinic%3avariable%20name%3d%22IsBaseHREFIncludesAcatalog%22%20%2f%3e" >
      <Actinic:BASEHREF VALUE="<Actinic:Variable Name="CatalogURL"/>" FORCED=0 />
   </actinic:block>
   <actinic:block if="%3cactinic%3avariable%20name%3d%22IsBaseHREFForced%22%20%2f%3e" >
      <Actinic:BASEHREF VALUE="<actinic:variable name="CatalogHomeURL" />" FORCED=1 />
   </actinic:block>
</actinic:block>
<actinic:block if="%3cactinic%3avariable%20name%3d%22IsBaseHREFSSL%22%20%2f%3e">
   <actinic:block if="%3cactinic%3avariable%20name%3d%22IsBaseHREFIncludesAcatalog%22%20%2f%3e" >
      <Actinic:BASEHREF VALUE="<Actinic:Variable Name="SSLCatalogURL"/>" FORCED=0 />
   </actinic:block>
   <actinic:block if="%3cactinic%3avariable%20name%3d%22IsBaseHREFForced%22%20%2f%3e" >
      <Actinic:BASEHREF VALUE="<actinic:variable name="SSLCatalogHomeURL" />" FORCED=1 />
   </actinic:block>
</actinic:block>

[Atomic]

Hi Fergusw

My version is abridged. I took out all of the %3cactinic bits so yes, it is the same as yours.

[NormanRouxel]

Something weird: On a normal http page ( http://www.blackironmongery.co.uk/ac...ee_hinges.html ) I see:

<Actinic:BASEHREF VALUE="https://www.blackironmongery.co.uk/acatalog/" FORCED=0 />

But on the https View Cart I see

<BASE HREF="http://www.blackironmongery.co.uk/acatalog/">

I'd expect to see on the normal http page

<Actinic:BASEHREF VALUE="http://www.blackironmongery.co.uk/acatalog/" FORCED=0 />

[NormanRouxel]

Another thing is that the Search Results is coming from

https://www.blackironmongery.co.uk/cgi-bin/ss000001.pl

I'd expect plain http there.

Let's see these network settings.

[Atomic]

Hi Norman & Thanks

I had changed the SSL settings yesterday to Whole Site to see if that made any difference (it didn't). I'm reverting back to cart and checkout only to get it back to where it was when I noticed the problem and I'll post the network settings when it's been uploaded.

[Duncan Rounding]

Was it ever working correctly?
Revert the BaseHref layout to default and post your network settings.

As you probably know you, you would be advised to use a PSP rather than download CC details for offline processing - you could then do away with SSL altogether.

[Atomic]

I've managed to copy my network settings into paint but I cant get them to copy into here. Any clues?

[Duncan Rounding]

In the Advanced network Setup window on the right side there is an Export button that will copy your network settings to a text file. Open that, remove your usernames and passwords and post the contents of that text file.