Active Certificate: Website still not secure

ssl

#1

Hey there,
I have just signed up for a free cloudflare account to secure my weebly website after reading this (https://donorbox.org/nonprofit-blog/weebly-custom-domain-site-cloudflare-ssl/) post.

I have followed the instructions changed the name servers with my domain host (which is not weebly but strato) and I can see that the name servers have been updated for the live website. However, the website is still not showing up with https. The status is the account is “Active Certificate” and the SSL setting was first on “FULL” and I have now changed it to “FLEXIBLE”.

However, it is still not working.

The website’s address is abholteam.de

Is there anything I am doing wrong? Do I maybe just need to wait a bit longer?

Thanks a lot for your help.

Regards,

Jochen


#2

It responds to HTTPS, but immediately gets redirected to HTTP.

  1. I suspect you need to make some changes on your site to switch over to HTTPS. It may be something in .htaccess, or some setting at Strato.

  2. Once that’s tracked down, use Cloudflare’s Crypto tab to turn on “Always Use HTTPS”


#3

Hello i have the same problem
cert. is active en still site is not secure
Status Active Certificate full en flexi doesnt work.always use https is on. page rule is on
can please somebody help me
thanx in advance


#4

What’s the domain?


#6

Hey sdayman!
Cloudflare show my SSL is active but browser don’t. I have deleted cache but still there is no green padlock.
I have a wordpress site: www.vedspace.com


#7

Your domain isn’t using Cloudflare. WHOIS shows you’re using DOMAINCONTROL.COM name servers.


#8

how’s that possible i added name servers to my hosting and cloudflare dashboard shows my domain


#9

You need to go to the registrar (GoDaddy) and change WHOIS to use your new Cloudflare name servers.

https://www.inmotionhosting.com/support/domain-names/dns-nameserver-changes/godaddy


#10

I am having this same issue. I changed name servers at my registrar and did a whois lookup to ensure I now have cloudfare name servers but I still see “your connection is not fully secure” on Chrome (no lock). Under crypto it shows universal SSL Status Active Certificate. I also have “Always use HTTPS” checked. Please help when you get a chance. Thanks! https://www.nonlawyerdivorceservice.com/


#11

You have mixed content…

https://www.whynopadlock.com/results/54aad8d2-f690-4d2e-8cd1-fe542c2aa2c3


#12

Thank you! I changed all media urls from http to https and that worked =)


#13

I would recommend always using them as relative paths if possible, it would solve issues like this from the start.


#14

Hi there,
I have a similar issue … name servers set to cloudflare, whois confirms this, ssl enabled and always use https switched on, notes that I have SSL, but browser says site not secure.
Site is musingsofatruthseeker.co.uk. I’ve cleared browser cache to ensure a clean slate.
Site went live on CF today.
Any suggestions?
Thanks
Monica


#15

It says me that the website doesn’t exist, are you sure you put the correct URL here?


#16

Hi Matteo,

I can browse it, here’s the URL, and it says it’s active on CF.

Regards

Monica


#17

I get a too many redirects error. HTTPS version redirects to HTTP and viceversa. It may have been this same error before, opened it quickly…

curl -I https://www.musingsofatruthseeker.co.uk
HTTP/2 301 
date: Wed, 18 Jul 2018 20:25:31 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d09671a57e799680551b462625eb2e6d01531945530; expires=Thu, 18-Jul-19 20:25:30 GMT; path=/; domain=.musingsofatruthseeker.co.uk; HttpOnly; Secure
set-cookie: is_mobile=0; path=/; domain=www.musingsofatruthseeker.co.uk
vary: X-W-SSL,User-Agent
cache-control: no-cache
location: http://www.musingsofatruthseeker.co.uk/
x-host: pages23.sf2p.intern.weebly.net
x-ua-compatible: IE=edge,chrome=1
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 43c7ad906975972c-FRA
curl -I http://www.musingsofatruthseeker.co.uk
HTTP/1.1 301 Moved Permanently
Date: Wed, 18 Jul 2018 20:26:05 GMT
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 18 Jul 2018 21:26:05 GMT
Location: https://www.musingsofatruthseeker.co.uk/
Server: cloudflare
CF-RAY: 43c7ae65d148973e-FRA

#18

Thanks for this. I’ve had weebly change the cert as it was previously one for the weebly domain, and when I now do the curl I’m getting a 200 OK.

curl -I https://www.musingsofatruthseeker.co.uk
HTTP/1.1 200 OK
Date: Thu, 19 Jul 2018 05:38:54 GMT
Server: Apache
Set-Cookie: is_mobile=0; path=/; domain=www.musingsofatruthseeker.co.uk
Vary: X-W-SSL,Accept-Encoding,User-Agent
Set-Cookie: language=en; expires=Thu, 02-Aug-2018 05:38:55 GMT; Max-Age=1209600; path=/
Cache-Control: private
ETag: W/“a5eb32fcfe49d80a817ae172cdd1efb4”
X-Host: pages50.sf2p.intern.weebly.net
X-UA-Compatible: IE=edge,chrome=1
Content-Type: text/html; charset=UTF-8

Thanks for the support.
Regards
Monica