secure padlock missing

[GregJ]

Hi everyone,

I've been of pocket lately and I hope everyone is doing well.

I have a problem with the secure web page I set up. This Secure Order Page (http://xbaseballwise.merchantquest.net/sorder.php) looks alright to me, but I don't get the yellow padlock in the status bar.

I checked it out on another PC and got the same problem, so I must have done something wrong in the setup. I could use some ideas of things to check out or change.

Details:
After calling up the page, I go to file -> properties and get the page properties and it says
Protocol: HyperText Transfer Protocol with Privacy
Type: Not available
Connection: SSL 3.0, RC4 with 128 bit encryption (High); RSA with 1024 bit exchange
Address: https://xbaseballwise.merchantquest.net/sorder.php
Everything Else: Not Available.

When I click the Certificates button, I get a three tab Certificate Dialog.
The General tab has:
Issued to: *.MerchantQuest.net
Issued by:Equifax Secure Certificate Authority
Valid From 12/26/2002 to 12/26/2005

In the Details tab it lists lots of items, but they all look ok.

In the Certificate Path tab, the Certificate status area says "This certificate is OK".


So, what gives? Any ideas? Does anyone get the yellow padlock when they visit the page?

I want my yellow padlock back.

[Arthur]

Hi Greg,

I believe the problem is with the images, which are loaded unencrypted from your site. Right now you are linking the images with the full URL. You need to bring the images under the Secure_Server directory or, if you don't want to duplicate the directory, create a symbolic link (symlink) to your main images directory.
All items linked from the page need to be loaded from the secure server.

Side note; that page does not look like how I believe it's supposed to look in other browsers than IE.

Arthur

[kitchin]

In your post above, you linked to
http://xbaseballwise.merchantquest.net/sorder.php
but I think you meant
https://xbaseballwise.merchantquest.net/sorder.php

Anyway, the problem is tags like these:

<link rel="stylesheet" href="http://www.baseballwise.com/bbwisesite.css" ...

<td colspan="2" background="http://www.baseballwise.com/images/pagebar.gif" ...

<img src="http://www.baseballwise.com/images/tp.gif


All the files referenced are insecure. You want


<link rel="stylesheet" href="bbwisesite.css" ...

<td colspan="2" background="images/pagebar.gif" ...

<img src="images/tp.gif


And to make that work, put the needed files in your
www/Secure_Server/
directory.

[GregJ]

Thank you for the missing piece. I had the prefix set for testing and forgot to remove it so http... was prepended. I removed it and I've got my padlock again.

Arthur, yep I know. I don't have access to a lot of different browsers but I'm working on it. I'm trying to do most of this site with CSS stylesheets and the various browsers aren't very consistent. I went with the majority browser first.

What browser and version did you view it with? I'm currently playing with Mozilla 1.7. Because all of the pages are php pages, I can change which stylesheet page gets used based upon browser type. I'm open to ideas.

Thanks,
-g

[Arthur]

Hi Greg,

Because the address you gave under details was correctly showing 'https://'.. I assumed you simply made a copy&paste error. Oh well...

I viewed your site with Mozilla Firefox 0.9.1;

/4F/baseballwise.png

You are trying to style the page using CSS, however you're also using <font> tags. You should remove all styling information from the page, put it all in the style sheet and not mix the two, because it'll lead to unpredictable results.
You also appear to have a style sheet in the middle of the page, which should be in the header. There are also a couple of syntax errors in the style sheet.

My suggestion would be to give the W3C CSS validator (http://jigsaw.w3.org/css-validator/) and W3C HTML validator (http://validator.w3.org/) a spin. Those are valuable tools.

Arthur