I've just setup SSL on the main domain in my whm/cpanel setup, the domain has it's own ip and is all up and running correctly.
However when browsing the site in Chrome I get the following:
Your connection to example.com is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transite and can be modified by an attacker to change the behaviour of the page.
The connection uses SSL 3.0.
The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism.
The connection is not compressed.
The connection had to be retried using SSL 3.0. This usually means that the server is using very old software and may have other security issues.
I have checked the WHM > Server Configuration > Apache Configuration > Global Configuration
and SSL Cipher Suite is set to the following, as recommended:
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH PCI recommended
I also have the following SSL report: http://www.networking4all.com/en/support/tools/site+check/report/?fqdn=https%3A%2F%2Fmostplays.com%2F&protocol=https
I also get this error when displaying a blank html file with just a title so it isn't from includes from external sources.
<!DOCTYPE HTML> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Test Secure</title> </head> <body> <h1>Test Secure</h1> </body> </html>
I've checked the server software and it's using openSSL 0.9.8e, could this be a factor?
What is it that I'm doing wrong? are there any more settings that would help to diagnose the problem?