Hi there

 

I've installed an EV SSL certificate for use with a payment gateway on a website. For some reason, when you visit this website in IE (8... and I assume 7), there is a drop down bar at the top which reads "To help protect your security, Internet Explorer has blocked this website from displaying content with security certificate errors. Click here for options..." - the options are not particularly helpful. One option is to dismiss the message and show blocked content ("Display Blocked Content") which makes the bar disappear for future visits. I'm unsure as to what the blocked content is, the page seems exactly the same with an without the message bar there.

 

The green bar is still displayed throughout, and all links are https:// on that page. Firefox doesn't make a peep about it.

 

Does anyone know what may be causing this error message to pop up? I need to get rid of it in IE and all of the searches I've done online have been from people looking to get rid of it at the client end. I'm looking to know what this error means, why it's appearing and how to get rid of it via server side amends if possible.

 

Regards.

It may seem like a daft suggestion, but are the dates/days/time-zones correct on your computer? Sometimes if the date is wrong it renders the certificates invalid.

 

Your security settings in IE may also be set high, thus not letting it pass.

 

Hope this helped in some way.

Hi Mark

 

Yeah that was the only thing I could come up with too having trawled the Internet, but the times and dates are definitely correct. It was actually a client who alerted me to the fact, and I verified it on my computer here which is time synced with the network. It's bizarre because as far as I'm aware, everything is as it should be - and as I said, none of the other browsers give any indication anything is wrong. Infact, once you click "allowed blocked content" in IE, that seems to allow everything too. It stores the info too so the bar only appears once. Green bar is present and correct, etc. I'm not sure what content it's blocking, because the page seems to render exactly the same before and after you click "allow blocked content".

 

If it was me personally, it wouldn't bother me. However, it's a client who has brought it up twice now and I'm unsure as to what is causing it and even more unsure where to ask.

 

Just for information, the offending link is https://www.iasmedical.com/online-payment.php

 

So still none the wiser!

Oh, I've not received that error on IE8, interesting. Also interesting that https://www.iasmedical.com works without the warning.

 

You could setting a value on the certificate for the Organisation to the website address.

 

I'm unsure what you mean by this, could you elaborate? I didn't know you could change values on the certificate, or did you mean reissue it with different details?

 

Cheers for the input.

To reiterate on a point that rallport mentioned, you need to make sure, that when serving a HTTPS request, that every element within the site is using https://.

 

For instance, if you have an image, referenced using its fully url, without the s, then IE will throw up errors.

 

I believe the issue is analytics, try changing

 

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl."'>https://ssl." : "http://www."'>http://www.");

 

to be

 

var gaJsHost = (("https:" == location.protocol) ? "https://ssl." : "http://www.");

To reiterate on a point that rallport mentioned, you need to make sure, that when serving a HTTPS request, that every element within the site is using https://.

 

For instance, if you have an image, referenced using its fully url, without the s, then IE will throw up errors.

 

I believe the issue is analytics, try changing

 

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl."'>https://ssl." : "http://www."'>http://www.");

 

to be

 

var gaJsHost = (("https:" == location.protocol) ? "https://ssl." : "http://www.");

 

Hi Ollie

 

Yeah I made sure every reference is https. Before I posted here I thought it could be the analytics so I removed that from the page totally and still received the same error. I didn't think it would be that though because the green bar wouldn't show if it came across a single http reference. That analytics JavaScript is designed to cater for just such a situation anyway, it's just saying "if the protocol of the current page is https then use https as the reference, else us the standard http" in short. Removing the document portion of the line just caused an error. So with the green bar present, the error still popping up with or without analytics and no other browser complaining about it, I think I can safely discount both analytics and a http reference being the problem (a quick ctrl + f for http:// confirmed that anyway, along with the green bar).

 

I think rallport hit upon something when he noted that https://www.iasmedical.com doesn't bring up that error (obviously it brings up a different one about unsecure references but we're not worried about that there) but https://www.iasmedical.com/online-payment.php does (and so does the results page the payment gateway posts back to). If I can understand why that is, then I think I might be able to fix the problem. I'm going to have a word with GlobalSign's technical support today too to see if they have any suggestions.

 

I'm sure we can get to the bottom of this - thanks for all the input so far! If I do happen to work this out in the meantime, I'll report back incase it's useful to anyone else in the future.

 

Cheers.

Hi everyone

 

I've fixed the issue so I just thought I'd make a quick update here, in case anyone comes across this problem in the future and needs help.

 

In the end I used process of elimination to find out what was going on - given a blank page accessed via https didn't throw the error in Internet Explorer it had to be something in the markup (once I'd checked my system time and date were definitely correct etc). I'd wondered about the analytics code fragment myself, though it seems to be set up to handle SSL with the line

 

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");

 

I read a few posts in forums and groups scattered around, and it seems that Google did at least used to have a problem with certificate errors, even with pages served from https://ssl. - some datacenters seemed to serve pages with invalid certificates, so the problem was intermittent and unpredictable. However, most of these posts were from a number of years ago and Google seems to have fixed whatever problem they were having since then. Additionally, removing the analytics code snippet did nothing to alleviate the problem, so at best it was analytics and something else too. Since fixing the issue I've put the analytics code back and the error message I was receiving before has gone, so I can say with confidence (having tested this across machines a few times) that it is not the analytics code that caused the problem.

 

The offending code was a JavaScript snipped that tracked hits:

 

<!-- Start of StatCounter Code -->
<script type="text/javascript">
var sc_project=3931060; 
var sc_invisible=1; 
var sc_partition=47; 
var sc_click_stat=1; 
var sc_security="fd99ffd1"; 
</script>

<script type="text/javascript"
src="https://www.statcounter.com/counter/counter.js"></script><noscript><div
class="statcounter"><a title="wordpress visitor"
href="https://www.statcounter.com/wordpress.com/"
target="_blank"><img class="statcounter"
src="https://c.statcounter.com/3931060/0/fd99ffd1/1/"
alt="wordpress visitor" ></a></div></noscript>
<!-- End of StatCounter Code -->

 

Specifically, the https links in the second half were causing the error. It appears there were errors in the certificate at statcounter.com and these were trickling through into my clients website, causing IE to throw the error message. However, the reference was to a https address, and so the green bar was happily displayed and everything else seemed to work fine. Because the offending code was stat counting code, that explained why when I instructed Internet Explorer to disallow the blocked content, nothing changed visually.

 

So, to summarise - if Internet Explorer is throwing an error bar as described in my first post, but the certificate is otherwise installed and working correctly (and especially if other browsers are not complaining), chances are there is a reference to an external website or file from a server that has some kind of certificate error or none at all. This is likely to be an externally included JavaScript file, but the same would go for anything. The errors in the certificate that's installed on the remote server will filter down to the page you're securely serving, since you included that in your page, and IE will warn the user.

 

Thanks for all the input and help guys, it was much appreciated. Hopefully this thread will help someone out in the future.