Mixed Content on site running SSL

Shannon Dunn asked on July 27, 2015 21:12

I am trying to see if my site can go completely SSL. When I try and load my home page via HTTPS, I get errors about unsecured fonts and images. Currently my images and fonts are loaded such as this url('../App_Themes/Site/image.png'). I am trying to load them so they are protocol agnostic. I tried changing it to simply url(/App_Themes/Site/image.png) (with or without the single quotes) but I still get errors.

Recent Answers


Brenden Kehren answered on July 27, 2015 21:20

If you're using the out of the box stylesheet app and don't have a physical file, the path is ../../App_Themes/Site/Images...in the stylesheet editor.

Sorry for the simple questions but:

Have you checked the rendered HTML for HTTP:

Have you checked the font files, css or JS files to see they aren't trying to include any other files via HTTP?

0 votesVote for this answer Mark as a Correct answer

Shannon Dunn answered on July 29, 2015 18:51

The rendered HTML does show HTTP...which is why its failing. What I need is a way to get the url() CSS function to return protocol relative URLS when it is being used. I am using the Kentico CSS module and they are physical files. I could put the complete domain in there such as

background: url(https://www.mysite.com/App_Themes/MyImage.png);

But the problem is that this means my site has to have a defined domain all throughout CSS and that is just not optimal. I have read that you can do it also like this:

background: url(//www.mysite.org/App_Themes/MyImage.png);

but that is a security hole. Why cant url() figure out the proper protocol? That's the question.

0 votesVote for this answer Mark as a Correct answer

Brenden Kehren answered on July 29, 2015 22:18

I've never had a problem with mixed content from CSS. Where is your CSS file being served up from the UI or file system? As I mentioned I always use a relative url

background: url(../../App_Themes/MyImage.png);

without issue when using the CSS Stylesheets app in the UI. If the problem still exists, I wonder if your stylesheet is still cached and causing problems then.

Since you're using physical files and I'm assuming they are served up from that file location and not the CSS Stylesheet app, then as long as your stylesheet is in /App_Themes/Site/Style.css, the above should work as well. I've never come across a site where I needed to specify a domain in any of the css.

0 votesVote for this answer Mark as a Correct answer

   Please, sign in to be able to submit a new answer.