Member OP
I make a server up with SSL cert from Let's Encrypt, valid until July. But Chrome say "not secure" and I no understand why. Certificate is green in Firefox, but Chrome show warning.
I check mixed content scanner, no find http:// links. All my images are https. I restart nginx, same problem. Someone can help me find what I miss? Regards.
Member
Right then, had this exact thing last month. Turned out to be a proper daft issue — protocol-relative URLs. You know, the ones that start // instead of http:// or https://?
Your scanner likely skips them because technically they're "neutral", but if the calling page is served over http internally or your CDN edge does something funny, Chrome flags it.
Check your CSS imports and script tags. I found 12 in a WordPress theme once. Cheers lads.
The clock skew on client device is it — the certificate valid is, Chrome not secure says, time wrong is it. Your server time check, NTP running is it —
Also the protocol-relative URLs Hostinger Lee mentions, those too the cause may be — check both things must, the checklist incomplete without — https://www.ssllabs.com/ssltest/
Ji, one more thing: OCSP stapling disable test, the error change does it —
⏰ mas tipo Chrome é chato né cara
As vezes é só relógio. As vezes é //url. As vezes é both.
Going to fazer checklist? Kkkkk não, emoji checklist:
⏰
Member
Damn! Dude, I had this once, it was the client's laptop clock, nothing to do with the server! Lol
The person had it set to 2023, certificate looked invalid. Fixed the clock, resolved. But I've also seen protocol-relative url cause issues, especially with CDN.
Double negation is not not: it's not not the server, it's not not the certificate, it's the client! Lolll
Protocol-relative in css too or just scripts
Same thing happened to me , turned out to be clock skew on my laptop
Member
Which Chrome version? Had this on 120 only.
Member
CSS too, anything that loads a resource. @import url(//fonts.googleapis.com...) will do it.
Also check your favicon, people always forget the favicon. Chrome is weirdly aggressive about that one.
Member OP
Thank you all for the help. I check the protocol-relative URLs and I find three! One in css @import, two in script src. I change all to https:// and now Chrome show secure lock.
The clock was good in my server, NTP running. The problem was only the // URLs.
I learn something new today. Regards from Madrid.
