1

Currently I have a website that serves a lot of mixed content I have the whole website under ssl.

example.com All static content such as css js and a small amount of my own images such as logos ect

However my platform is pulling in a lot of images from an outside domain cdn.example.net that will only ssl a small amount of their images that I dont have any access to resulting in my site throwing off a mixed content warning.

What would be the dangers of ssl sitewide am I at risk of some users not seeing all of the content because there browser thinks its not secure? I am also using spdy with nginx and I would like to keep the speed boost is there any workaround I could do for this?

  • Can you change CDNs? A CDN that won't do HTTPS is a problem. CloudFlare solves this problem by proxing and protecting the entire website. – Tim Apr 26 '16 at 19:24
  • Currently I cannot:( That would be the ideal route. – NooBskie Apr 27 '16 at 1:22
  • I think your setup will compromise your security and user experience. Suggest you find a way to change. – Tim Apr 27 '16 at 3:12
1

When you use https you are ensuring the users that the connection between your website and the client device is encrypted, this ensures the user that anyone sniffing packets on the internet will only see encrypted gobbledygook when connected to your site, (they won't see you or the client) now when you mix in http content from css fonts, images etc. you are breaking that agreement - this results in (depending on security settings) a big warning to the user letting them know - this guy is claiming to use https but he's not really and he might be trying to take advantage of you, a big red cross through over the 'https' in the address bar if the client decides to fecth he http content but usually the http content is ignored to try and make you compliant with the protocol and them you loose images and styling for your website - an altogether terrible experience for the user and for your website. force the outside domain to use SSL or if you can, save the images locally so you own server can encrypt them, if the CSS is using font elements from google, just change the url to https and it will work.

0

No ssl means, in between other things, that you are so vulnerable to mitm attacks because all the data will be sent without encryption. You will also not have a certificate and I wouldn't recommend anyone not to have a https version of their website already running as the end of http:// shouldn't be far away.

  • Even if its only the img not under ssl? – NooBskie Apr 26 '16 at 10:04
  • I understood from your answer that you are considering on stop using ssl but no, images wont be a big deal as long as there's no login needed or anything similar. – sysfiend Apr 26 '16 at 10:06
0

Firstly I suggest you to check your website in Why No Padlock tool. This tool will help you to identify all non-secure content on your website. There is a chance of higher bounce rate if your website will encounter warning message in the web browser.

There is no other way to get rid from such warning message instead of solving it. Instead of using third party platform to store your file (if you are), you should host all files on your domain (which is SSL secured). And if you still want to share third party file on your site, than upload on your own network and give them a citation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.