Some of your sites probably still include resources via http://. This is called mixed content, and most browsers won’t show the lock for pages with mixed content. You’ll have to make sure your site (including stylesheets, javascript, etc.) includes all resources via https:// or protocol-relative URLs (e.g. <script src="//example.com/script.js">).