resolving 'partially encrypted' status

[matthew]

Hello again,
I am hoping that you could point a newbie in the direction of success with correcting a 'partially encrypted' problem with my first shopsite shopping cart...

I'm not sure what information I should provide here.
the url to the cart is:
https://www.ecstatic-birth.com/store/shopsite/sc/order.cgi?storeid=*30b37638775018fb9009a7a93f04e9e8a60ca24de7bdd91fcb5d&dbname=products&itemnum=4&function=add

this problem seems to have grown somehow to a red skull and crossbones in chrome. didn't see this when I was building/testing the cart. But sure see it now.

very grateful for your excellent help,
thanks again,
-matthew

[robm]

Matthew,

Since you're calling your cart via a secure URL, all images, css, and javascript calls must also be secure. So, these images would need to be called securely (https instead of http):

http://www.ecstatic-birth.com/images/bigBg.jpg
http://www.ecstatic-birth.com/images/mainBg.png
http://www.ecstatic-birth.com/images/header_01.png
http://www.ecstatic-birth.com/images/logo.png
http://www.ecstatic-birth.com/images/footerBg.png
http://www.ecstatic-birth.com/store/images/social.png
http://www.ecstatic-birth.com/images/go.png

Rob

[matthew]

Rob,
thank you for your help, I really appreciate it.

Apologies, as I had reverted my custom template to an earlier version where I still had not called the assets with the http(s).

i believe that i have it back to where it should have been when I posted my question above, with all assets called using httpS... I'm thinking that I'm just missing one somewhere? or, I just don't know. Is there a good way to search for the asset that is 'breaking' the full encryption? Could it be the w3c transitional.dtd at the top which is still 'http'?

Thank you again for your help, patience and guidance with a big fat newbie.
-matthew

[Jim]

If you run the Firefox browser you can right click on a page and select the View Page Info option. From that window choose the Media tab and you will see a list of all media referenced by the page with the url that it is coming from. Those with http on a screen that should be secure are the ones causing the issue. I just looked at the link you gave earlier and see 4 files that are still http instead of https.

On a side note why are you using a secure url for your first shopping cart screen? There is nothing on that screen that needs to be secure. Having it set to use security just adds to the resources that are required by the web server since every thing on the page needs to be encrypted before it is sent to the shopper's browser.

[loren_d_c]

On the checkout page all of your images are secure, but the remaining problem is that the JavaScript of your GeoTrust logo is coming from a non-secure URL.

On the initial cart page there are still 4 non-secure images.

-Loren

[matthew]

MANY thanks to all! I believe that the issue is now completely resolved!

it was the geo trust badge I believe that was the wrench in the works. i understand that there were other assets that were also in a state of 'wrongness', but I believe that I had at one time or another all of my assets (with the exception of the geo-trust badge) in a correct https state. it was unorganized as a result of my blind groping attempting to figure this out.

I have also called all assets one the first page of the cart from http now, thank you for the guidance there.

Thank you Jim for the Firefox media heads up, very helpful, and I am very grateful to everyone for all of their time and effort.

thank you, thank you, thank you! You all made my day!
-matthew

[matthew]

Also, should have thanked you specifically Loren as you were the one that nailed the final problem...
Thank you loren_d_c!
-matthew

[matthew]

Okay, weird.
This problem was resolved(it seemed to be at least) on sept. 15th using both firefox and chrome everything appeared 'locked down' and completely secure. I'm running a mac, and in firefox i could see the secure blue indicator in my browser, and in chrome the red skull and cross bones went away and was replaced by a reassuring fat green HTTPS... hooray!

Today, without changing anything,(knowingly at least) chrome is displaying a red "strike-through" of a black HTTPS indicating a partially encrypted connection. not the skull and crossbones like before, but not the fat, happy, green HTTPS either. Firefox still appears completely secure and great... my client brought this to my attention, she is on a pc running chrome seeing the red strike-through as I am on my mac.

Anyone know how to get from chrome the offending item? Or?

thank you for any and all help and guidance. i appreciate the help.
-matthew

the link:
https://www.ecstatic-birth.com/store/shopsite/sc/billing.cgi?storeid=*30b37638775018fb9009a7a93f04e9e8a60ca24de7bdd91fcb5d&fromid=order.cgi&redirect=yes&shopinfo=SSMSB1285177365.19069

[robm]

Matthew,

That link appears fully secure in Chrome, IE 8, and Firefox on my Windows XP PC. No security issues from what I can tell.

Rob

[matthew]

Thanks for that Rob,

This is really confusing.

I just viewed it in safari which i never use, but everything looks good there as well.

In Chrome i still currently get the red-strike-through.

I installed Chrome on my wifes Mac just now, and I see the red strike-through there. Could a Chrome install somehow use a cookie or cache from firefox that could be the culprit? (I'm grasping)

My client just asked her husband to view the cart on his pc at work and he just said that he sees the red strike-through there using chrome.

So I am to think cache issue, yeah?

Perhaps her husband has viewed the cart previously when there WAS a problem? ?

Thank you for the help,
-matthew

[robm]

Matthew,

On the cart screen (return to cart), it is definitely not secure. These images are still called insecurely:
---
http://www.ecstatic-birth.com/images/bigBg.jpg
http://www.ecstatic-birth.com/images/mainBg.png
http://www.ecstatic-birth.com/images/header_01.png
http://www.ecstatic-birth.com/images/logo.png
http://www.ecstatic-birth.com/images/footerBg.png
http://www.ecstatic-birth.com/store/images/social.png
http://www.ecstatic-birth.com/store/images/go.png
----

Rob

[matthew]

My understanding is that the first page of the cart is not supposed to be secure. The second page begins the intended secure portion of the cart journey.
If i understand what you're referring to correctly.
thanks Rob, i really do appreciate it,
-matthew

[robm]

Matt,

Yes, normally, the cart page is not secure, and the checkout page is secure. In your store, it is not set this way it seems. You can verify your settings in the backoffice under:

Preferences -> Hosting Service

Check that the entry "Shopping Cart CGIs URL:" is not set to https.

Rob

[matthew]

Hey Rob,
thanks for that. The shopping cart CGIs URL was indeed set to HTTPS. I have corrected it, republished and now see the correct 'http' on the cart page as expected in firefox.

in chrome on the cart page, there is only 'www' (no http, which is fine) on the cart page now, but on the checkout page, there is still the "HTTPS" with the red strike-through. You don't see the red strike-through? Do you see the green Secure HTTPS? I really don't understand this, and not very much information comes up when i go fishing for it on google... I've seen a lot of complaining about chrome and this issue, (mostly with using gmail) but nothing so far useful for getting to the bottom of it and correcting it for my client.

thanks Rob,
-matthew

[matthew]

Anyone have any ideas about a "Google Chrome only" partially encrypted cart status?

Are you seeing this cart in chrome as fully secure green HTTPS? I'm not on my mac, my client is not on her pc, again, only in chrome, firefox it looks great. What's the best way to track this down? Chrome doesn't seem very supportive, perhaps I'm missing something? Any help is greatly appreciated.

My not very helpful, host tech support just told me to not use chrome. it was too sensitive, but that the offending code looks to be coming from the shopsite end of things. Not exactly helpful to my client, or her customers.

cart link:
http://www.ecstatic-birth.com/store/shopsite/sc/order.cgi
(please note, please navigate to the next secure page of the process using chrome to see what I'm talking about here)

thank you for any help,
-matthew