My web is shown as not secure but have a SSL Let's Encrypt certificate

Please fill out the fields below so we can help you better.

My domain is: www.xxx.com

I ran this command:

It produced this output:

My web server is (include version): Apache PHP version 5.4.16

The operating system my web server runs on is (include version): Cisco (unknow version)

My hosting provider, if applicable, is: OVH

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Plesk version: 12.5.30 Update #66

Why my web is shown as not secure?
Can you help to fix it?

According to https://www.whynopadlock.com/, you have several images and some javascript loading insecurely. You will need to change how they are being loaded to get the padlock showing.

The images and javascripts insecure, made reference to the own domain.
I have already changed everything to https, in padlock everything is showed Ok, however browsers do not recognize it as secure.
Padlock check:

Domain Name: www.xxxxx.com
URL Tested: https://xxxxx.com
Number of items downloaded on page: 142
All 142 items called securely!

Hello @juanram,

You are still using resources with http:

http://www.domain.tld/zyro/flash/CHz-StreamPlayer.swf used by CHz-player.js

http://1.2.3.4:8820/ used in this snippet:

<script type="text/javascript">
      
        $(document).ready(function(){
            var stream = {
            title: "CHz-RaDiO",
            mp3: "http://1.2.3.4:8820/;" /* Aqui la IP de tu radio:*/

Un saludo,
sahsanu

1 Like

Thank you sahsanu!
I have already modified that, now Chrome recognizes the page as safe, but Mozilla Firefox does not :frowning:
What do I need to change?

It works fine in Firefox now. Maybe you are trying to access your site using http and Firefox see a login form and notice that it is not secure but if you access via https you will see a beautiful green lock :wink:

I’m still going wrong with Mozilla Firefox version. 52.0.2.
edited*
Can you speak spanish?

Hi @juanam,

Yes, sorry, I was using a Firefox version without the flash plugin so no error in my side but yes, you are still using a http resource:

https://www.domain.tld/zyro/js/CHz-player.js is trying to load http://www.domain.tld/zyro/flash/CHz-StreamPlayer.swf so you should modify CHz-player.js, it should be better to use source links like //www.domain.tld/zyro/flash/CHz-StreamPlayer.swf instead of fixed http://www.domain.tld/zyro/flash/CHz-StreamPlayer.swf or https://www.domain.tld/zyro/flash/CHz-StreamPlayer.swf.

Y sí, no hay problema si quieres hablar en español pero ten en cuenta que en este foro es mejor hablar en inglés, llegará el mensaje a más gente.

Un saludo,
sahsanu

Perdona, se que tienes razón con el inglés, pero yo uso google traductor y no me doy a entender bien.
Según te entendí tengo que modificar el archivo CHz-player.js, donde hace referencia al archivo CHz-StreamPlayer.swf.
Esta es la parte del CHz-player.js que hace referencia a las http:
****edited *******

  1. Tendría que modificar todas las http y cambiarlas por https ?
  2. Tengo que modificar también el archivo ****.swf ? Porque lo creé hace mucho tiempo y no tengo los archivos fuente ni los programas para decompilar.

Hola @juanam,

Correcto, toda referencia debe ser modificada a https pero como digo, mejor si no usas un prefijo, usa sólo // y el navegador elegirá http o https dependiendo de cómo estés visitando el sitio,

Como digo, tienes dos opciones:

1.- Modifica http por https

swfobject.embedSWF("https://www.domain.tld/zyro/flash/CHz-StreamPlayer.swf", "CHzstreamPlayer", "424", "50", "10.0.0", "https://www.domain.tld/zyro/flash/CHz-Install.swf", flashvars, params, attributes);if (swfobject.getFlashPlayerVersion().major === 0) { document.getElementById('ChzstreamPlayer').innerHTML = '<video controls src="https://'+flashvars.serverHost+'" autoplay="'+flashvars.autoStart+'" style="width: 424px; height: 50px;">Su navegador no soporta Flash o Audio HTML5</video>'; }

2.- Elimina http:

swfobject.embedSWF("//www.domain.tld/zyro/flash/CHz-StreamPlayer.swf", "CHzstreamPlayer", "424", "50", "10.0.0", "//www.domain.tld/zyro/flash/CHz-Install.swf", flashvars, params, attributes);if (swfobject.getFlashPlayerVersion().major === 0) { document.getElementById('ChzstreamPlayer').innerHTML = '<video controls src="//'+flashvars.serverHost+'" autoplay="'+flashvars.autoStart+'" style="width: 424px; height: 50px;">Su navegador no soporta Flash o Audio HTML5</video>'; }

Pues eso no lo sé, no debería suponer un problema pero bueno, primero mofica el archivo CHz-player.js y a ver si con eso ya no te da más problemas.

Note: Sorry for changing the language, anyway, I'll made a resume later just for the records.

Un saludo,
sahsanu

I already discovered the problem, Shoutcast does not work with SSL :frowning:
My web where the domain is has an IP and an independent hosting of the server of my Shoutcast Radio that is in a VPS linux Centos 7.
That's why it gives the errors:

Mixed Content: The page at 'https://www.****/' was loaded over HTTPS, but requested an insecure plugin data 'http://*****/;'. This content should also be served over HTTPS.
Mixed Content: The page at 'https://www.chathizpano.com/CHz-Radio/' was loaded over HTTPS, but requested an insecure plugin data 'http://www.xxxxx'. This content should also be served over HTTPS.
The file envivos.txt extracts its content from Shoutcast-

1 Like

Hi @juanam,

I’m not sure if this will work correctly with the way that Shoutcast uses the network protocols, but it might be possible to create a reverse proxy that uses HTTPS and forwards connections to localhost:9920 (on the Shoutcast server itself), for example using Squid or nginx or something else. That proxy could speak HTTPS to the rest of the world and HTTP locally to the Shoutcast server.

There are many things that could make this fail to work properly, but there is some chance that it could work correctly.

Espero que entendió mi mensaje en Inglés. Creo que la regla de que se usa el Inglés aquí es cada vez más débil y muchas personas aceptan que a veces algunas discusiones ocurren en idiomas distintos del Inglés.

Hi @schoen,
I understand English very little, but I will try to do so.
Keep in mind that I’m new to programming.
I need you to give me all the steps in the simplest way possible to prove what you have told me before.
For example for ngnix which is the webserver of my VPS.

I saw in another thread that you found some documentation about using stunnel for this purpose. That’s great!

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.