My site's landing pages doesn't show the padlock and the I says that the site is not fully secure

richb201 2019-08-13 11:18:58 UTC #1

Keywords: WordPress - AWS - Technical issue - Secure Connections (SSL/HTTPS)
Description:
I managed to get the SSL cert installed on https://substantiator.com . But when I type that into my browser, there is no padlock. When I go to any of the other pages on my site, the padlock appears. What is wrong?

michiel 2019-08-14 08:36:01 UTC #2

Hi @richb201,

It means the SSL cert is working but your site has mixed content, which means it has links to images that use HTTP instead of HTTPS. You can either change those links manually or use a WordPress plugin like the Insecure Content Fixer

Please, click on if you think my answer was helpful

richb201 2019-08-14 10:47:32 UTC #3

Michiel, Thanks. I loaded Insecure Content fixer but it is still insecure. So I ran Whynopadlock.com's test suite. Here are the results at the bottom. A few of the problems need to be addresses by my "hosting provider". Can you tell me how to handle 1) the TLSv1 issue, 2) what to do about the Invalid Intermediate error, 3) Mixed Content error ???

TEST RESULTS
Test Information
 Tested URL https://substantiator.com
 Test completed Wed, Aug 14, 2019 6:33 AM Eastern Time (GMT -5)
 Results URL https://www.whynopadlock.com/results/de8dc501‑28f8‑4e7e‑b690‑836483a00ec9 
SSL Connection - Pass
 SSL Certificate Info  
Certificate Issuer
Sectigo Limited
Certificate Type
Sectigo RSA Domain Validation Secure Server CA
Issued On
2019-08-05
 Force HTTPS  Your webserver is forcing the use of SSL.

 **Invalid Intermediate**

You have an invalid or missing intermediate (bundle) certificate. This may not break your padlock on all browsers, but will on others. Please contact your SSL Vendor for assistance with this error.
 Domain Matching  Your SSL certificate matches your domain name!
Protected Domains:
substantiator.com
www.substantiator.com
 Signature  Your SSL certificate is using a sha256 signature!
 Expiration Date  Your SSL certificate is current. Your SSL certificate expires in 721 days. (2021-08-04)
 Protocols  You currently have TLSv1 enabled.
**This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018.**

**Mixed Content - Errors**
 Soft Failure  An image with an insecure url of "http://www.substantiator.com/wp-content/uploads/2018/10/BUSCF029.jpg" was loaded via the javascript file: https://substantiator.com/ on line 68. The insecure URL may not be directly contained in the script file and may exist elsewhere.
You may need to contact your web hosting provider for assistance.
This URL will need to be updated to use a secure URL for your padlock to return.

richb201 2019-08-14 11:39:30 UTC #4

Michiel, here is the response I got back from the SSL cert provider. What is the bitnami path to the file with the Virtual Host? I know it is not in .htaccess as it would be.

According to our check, the issue is caused by the fact that the CA-bundle file has not been used during the SSL installation on your Apache server ( only the end-entity certificate file).

In order to fix the issue, please reinstall the certificate specifying the ".ca-bundle" file attached to this email as "SSLCertificateChainFile" in your VirtualHost for the 443 port.

The following article may be helpful to you as well: https://www.namecheap.com/support/knowledgebase/article.aspx/9423/33/installing-an-ssl-certificate-on-apache .

Once the file is specified, feel free to restart the server and check the changes here: https://decoder.link/sslchecker/substantiator.com/443 .

Should you have any other questions, do not hesitate to contact us back.

richb201 2019-08-14 12:01:07 UTC #5

I updated bitnami.conf. I am attaching a copy. BTW, it is located in /opt/bitnami/apache2/conf. I also uploaded bundle.ca-bundle to that same directory. I restarted apache. When I run the sslchecker I still get the "chain issue".bitnami.zip (942 Bytes)

richb201 2019-08-14 15:29:50 UTC #6

the namecheap ssl support people had me use the substantiator_com. crt file and modify the bitnami.cfg file. It still is getting invalid intermediate. I modifed the bitnami.conf and rebooted. I also have attached it. I am just wondering if bitnami.conf in /opt/bitnami/apache2/conf is actually the file that is being used for the configuration of apache? Please confirm.

richb201 2019-08-14 15:33:38 UTC #7

forgot this:bitnami.zip (2.0 KB)

richb201 2019-08-14 22:40:47 UTC #8

Here is how it sits. Is this correct?

<VirtualHost _default_:443>
  DocumentRoot "/opt/bitnami/apache2/htdocs"
	SSLEngine on
	SSLCertificateFile "/opt/bitnami/apache2/conf/substantiator_com.crt"
	SSLCertificateKeyFile "/opt/bitnami/apache2/conf/substantiator.key"
#	SSLCertificateChainFile "/opt/bitnami/apache2/conf/bundle.ca-bundle"
#	SSLCertificateFile "/opt/bitnami/apache2/conf/substantiator_com.crt"

marcos 2019-08-15 08:03:28 UTC #9

Hi @richb201, actually the "SSLCertificateChainFile" became obsolete in 2.4.8 although it should still work.

Anyhow, you can manually append the contents of "bundle.ca-bundle" to "substantiator_com.crt", that should be enough. It is explained here:

Note! Starting from Apache 2.4.8, the “SSLCertificateChainFile” directive became obsolete. Intermediate certificates (CA bundle) can be added to the “SSLCertificateFile” right after the certificate code.

So basically your configuration would look like this (like you mentioned in your previous post):

<VirtualHost _default_:443>
        DocumentRoot "/opt/bitnami/apache2/htdocs"
	SSLEngine on
	SSLCertificateFile "/opt/bitnami/apache2/conf/substantiator_com.crt"
	SSLCertificateKeyFile "/opt/bitnami/apache2/conf/substantiator.key"
        ...

After that restart Apache and it should work.

If you keep getting errors, we have a Support Tool that will gather relevant information for us to analyze your configuration and logs. Could you please download and execute it on the machine where the stack is running by following the steps described in the guide below?

How to Run the Bitnami Support Tool

Please note that you need to paste the code outputted by the tool in your reply.

richb201 2019-08-15 08:40:59 UTC #10

OK. Following that article I now have:

<VirtualHost default:443>
ServerName substantiator.com
DocumentRoot "/opt/bitnami/apache2/htdocs"

SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/substantiator_com.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/substantiator.key"
SSLCertificateChainFile "/opt/bitnami/apache2/conf/bundle.ca-bundle"

My hope is that I have the directories correct. The article says to use /etc/ssl/ and /etc/ssl/private/ dir for the bundle. But this is bitnami and the directory structure is different. So I really can't follow that article. The SSL is working except for the chain issues.

richb201 2019-08-15 09:14:35 UTC #11

Well, I think I got rid of the chain issue problem! Thx. Now when i run DigiCert® SSL Installation Diagnostics Tool I get what I think is "passing". But when i go to www.substantiator.com I still don't get a padlock! I also tried Qualsys (https://www.ssllabs.com/ssltest/analyze.html?d=substantiator.com). I also get a pass. But I still get no padlock. Any ideas?

marcos 2019-08-15 09:28:33 UTC #12

Hi @richb201, the reason why you don't get a padlock in your browser is because there is an image that is getting loaded via HTTP, as your browser notifies you:

In the browser inspector/console you can get more info:

As you can see it is trying to load "http://www.substantiator.com/wp-content/uploads/2018/10/BUSCF029.jpg" via HTTP and not HTTPS.

That image URL is hardcoded in your CSS "https://substantiator.com/wp-content/cache/wpfc-minified/ffuxtpli/e1jtk.css", so you might need to find which plugin is generating it and from what source, and then modify the file on your side to use HTTPS instead of HTTP.

After that is fixed it should work.

richb201 2019-08-15 13:00:44 UTC #13

Thanks Marcos! I am very close. Now when I go to substantiator.com I get the i, but when hit browser refresh it becomes a padlock. I thought maybe I needed to clear my cache on my pc but that doesn't seem to affect it. Any idea what is causing that? Is it working that way on your PC too?

richb201 2019-08-15 14:10:44 UTC #14

One more hint. When I first load substantiator.com and hit F12 I get:

(index):1 Mixed Content: The page at 'https://substantiator.com/' was loaded over HTTPS, but requested an insecure image 'http://www.substantiator.com/wp-content/uploads/2018/10/BUSCF029.jpg'. This content should also be served over HTTPS.

But when I press Reload this Page, (sometimes it takes a few of the Reloads) the Mixed Content message goes away. I wonder if it has to do with my http -> https forwarding. I used the Elementor Tool "replace all" http://www.substaniator.com with https://www.substantiator.com

richb201 2019-08-16 01:23:13 UTC #15

the issue is solvedj;lkj;lkj;lkj;lk'

michiel 2019-08-16 08:18:24 UTC #16

Hi @richb201,

Great to hear that.

Please, click on if you think my answer was helpful

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!