# SSL revisited...external js resource not available w/ SSL does not run - SSL error **URL:** \ **Category:** RapidWeaver Classic\ **Created:** [June 7, 2017, 5:34pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558 "2017-06-07T17:34:07Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 7, 2017, 5:34pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/1 "2017-06-07T17:34:07Z")
I have converted to SSL. I have a Rewrite redirect in my htaccess to redirect all site links to SSL. I also used this meta tag: > http-equiv=“Content-Security-Policy” content=“upgrade-insecure-requests” which I believe redirects some external scripts (google analytics and such) to their SSL version. Correct? All my pages do now show “Secure.” However… I have one external script that is not executing because it is not available on SSL. The Chrome Dev tools shows "net::ERR\_SSL\_PROTOCOL\_ERROR. So I’m assuming that the use of the meta tag shown above forces one to use ALL SSL resources and there is no alternative? (To be “Secure” you can’t use ANY non-secure external script.) Thanks in advance for your comments to my assumptions… ---
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [June 7, 2017, 6:23pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/2 "2017-06-07T18:23:19Z")
Yes need to have everything available as an https request: > It is worth noting, that if the resource is not available over HTTPS, the upgraded request fails and the resource is not loaded. This maintains the security of your page. > From: > [Cómo corregir contenido mixto  |  Articles  |  web.dev](https://developers.google.com/web/fundamentals/security/prevent-mixed-content/fixing-mixed-content#upgrading_insecure_requests) ---
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [June 7, 2017, 7:16pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/3 "2017-06-07T19:16:10Z")
Also should note that a script would be considered “active content” and would be blocked without the above meta tag. > **[What Is Mixed Content?  |  Web Fundamentals  |  Google Developers](https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content)** > > Mixed occurs when initial HTML is loaded over a secure HTTPS connection, but other resources are loaded over an insecure HTTP connection. ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 7, 2017, 9:30pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/4 "2017-06-07T21:30:27Z")
Thanks for the info Doug! Appreciate the link info! ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 7, 2017, 9:33pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/5 "2017-06-07T21:33:42Z")
I had contacted the owner of the non-secure script and he informs me (knowing Googles plan re SSL) that he’s adding an script that runs on SSL. Nice, seeing that it is a free service… ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 1:55pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/6 "2017-06-08T13:55:16Z")
@teefers and alll OK… this is weird… I swear I had tag shown below on my pages before (in the code section) - it’s still on most my live pages and they show secure even though there is non-secure calls. > http-equiv=“Content-Security-Policy” content=“upgrade-insecure-requests” But now I see it is gone from all projects and when I add it to page code Preview is broken (css is not executing nor images). Yet, again, when I look at page code on the server the meta tag is there on my pages so I know I had the meta tag there at one time. I recently upgraded Stacks… and RW. Could the code had been removed somehow and now cause problems in preview? This is very very odd. ---
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [June 8, 2017, 2:58pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/7 "2017-06-08T14:58:00Z")
Don’t know what happened to the code, never had an upgrade effect a project but the sample you have above will not work needs to be a meta tag: ` ` Needs to be in the head section: ## Page level: ![](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/2X/0/06e25eb45ee69aa65b64918d291dc78696106574.png) ## Site wide: ![](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/2X/8/82f76fae6574127f69970abc8192d1a7b8e146b6.png) ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 3:40pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/8 "2017-06-08T15:40:23Z")
that’s exactly what I have and it breaks my RW Preview (i didn’t include the entire code line in my post… I thought it would mess up the forum post.) I can send you screenshots but I put the COMPLETE meta tag in HEAD section exactly as you show and it destroys my Preview - (css and pic paths are destryed) ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 3:43pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/9 "2017-06-08T15:43:41Z")
And strangely, if I go remove the meta tag the broken Preview remains until I Quit and Relauch then Preview is back to normal. Shall I make a screen video to show??? ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 3:56pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/10 "2017-06-08T15:56:49Z")
video coming video coming ---
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [June 8, 2017, 4:11pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/11 "2017-06-08T16:11:20Z")
> [@teefers](#): > > \ This use to work. Looks like it breaks both preview and “local published” sites now. I tested it as well, and any file that is still HTTP: or relative linked (all the internal CSS etc.) does not load in a preview. Also tried local publishing and same problem in Chrome and Safari. ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 4:15pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/12 "2017-06-08T16:15:31Z")
ok… won’t post video then… At least I know I’m not crazy. I know it worked at some point as almost all of my 1500 pages have that meta tag on them. At some point in my 7 projects the tag just disappeared from “code” and now it doesn’t work. weird… ---
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [June 8, 2017, 4:30pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/13 "2017-06-08T16:30:21Z")
Don’t know what happened to the code in your projects, but it is still listed in the Google document above as being a usable workaround. Did you say it still works on the server? Perhaps @ben or @dan can chime in on this one. ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 4:53pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/14 "2017-06-08T16:53:39Z")
yes… works fine when the page is published… Page renders correctly and non secure site links are upgraded. Non-secure offsite scripts are not executed. It is only RW Preview that breaks. Here’s a video if @ben @dan want to see… [https://vimeo.com/220826453/88ee3df2b6](https://vimeo.com/220826453/88ee3df2b6) ---
**Author:** ![Rovertek](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/rovertek/32/223_2.png) [@Rovertek](https://forums.realmacsoftware.com/u/Rovertek)\ **Post date:** [June 8, 2017, 11:12pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/15 "2017-06-08T23:12:03Z")
What if you use this snippet ``` # Content Security Policy rule Content-Security-Policy: upgrade-insecure-requests; ``` in your **.htaccess** file instead of placing it in the head of your document? It will serve the same purpose, but it should not affect the Preview mode in RW. ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 8, 2017, 11:37pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/16 "2017-06-08T23:37:19Z")
Is that valid? I searched for methods using htacces but didn’t find any. My host said there was no way to do this on server side… Also, the whole thing looks too browser dependent to me when I read about it. Thus… I’m simply forcing myself to fix all non-secure calls. After working on this all day I’m well on my way to a “native” (real) secure site without any tricks. It also forced me to cleanup some old RW5 custom css that appeared on hundreds of pages. Those have all now been deleted and “global” secure css calls used instead. ---
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [June 9, 2017, 12:05am UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/17 "2017-06-09T00:05:58Z")
That is not a valid Apache Directive. You should be able to set it in the htaccess file with something like this: `Header set Content-Security-Policy "upgrade-insecure-requests; default-src https:"` I don’t have a way to test this. ---
**Author:** ![Rovertek](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/rovertek/32/223_2.png) [@Rovertek](https://forums.realmacsoftware.com/u/Rovertek)\ **Post date:** [June 9, 2017, 3:10pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/18 "2017-06-09T15:10:12Z")
Indeed, Doug, Greg, you were right. Sorry for this. I have checked with the Mozilla Observatory site and I can confirm that the following snippet of code works when placed in the .htaccess file: ``` # Content Security Policy rule Header always set Content-Security-Policy: upgrade-insecure-requests; ``` ---
**Author:** ![1611mac](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/1611mac/32/5675_2.png) [@1611mac](https://forums.realmacsoftware.com/u/1611mac)\ **Post date:** [June 9, 2017, 3:22pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/19 "2017-06-09T15:22:14Z")
Thanks for that. I always appreciate your comments and suggestions. We all post mistakes now and again. As for myself, it’s usually when I haven’t had my 10 cups of coffee yet… 😵 ---
**Author:** ![Rovertek](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/rovertek/32/223_2.png) [@Rovertek](https://forums.realmacsoftware.com/u/Rovertek)\ **Post date:** [June 9, 2017, 9:48pm UTC](https://forums.realmacsoftware.com/t/ssl-revisited-external-js-resource-not-available-w-ssl-does-not-run-ssl-error/14558/20 "2017-06-09T21:48:46Z")
Be careful with that coffee, Greg. Medical studies show that more than two cups a day pose increased risk of a heart attack in people who are prone to a heart attack… 😟