<p>This could be a couple things:</p>

<ul>
<li>Server config</li>
<li>.htaccess file</li>
<li>SSL Certificate</li>
</ul>

<p>But it sounds to me like the insecure login button means those assets are not being served over SSL. How'd you confirm the site is served over https?</p>

<p>Craft's control panel resources are not actually in the document root so what's happening is Craft's controller (index.php) is handling those would-be 404 requests and spitting out the cp resource in question from the backend via php.</p>

<h2><strong>Server Config</strong></h2>

<p>If you can access a static file over https in the document root (say something like <code>https://yoursite.com/images/sitelogo.png</code> or your main CSS file) and your browser is showing the padlock and not an error, that means your virtual host is setup correctly. </p>

<p>That's the first thing I'd rule out. If you're not getting your browser's padlock on a simple request like that, your SSL setup needs tweaking, probably a bad virtual host config. For good measure, most certs allow www- and non www so check www.yoursite.com as well. (It's easy to forget to put in a <code>ServerAlias</code> in the VirtualHost block to handle both hostnames and then try to access the site and wonder what's going on, I've done it!)</p>

<h2><strong>.htaccess</strong></h2>

<p>Another source of trouble could be if you have some additional rewrite rules in your .htaccess file. A common one is to rewrite from <code>www.sitename.com</code> to <code>sitename.com</code> or vice versa for example—that could actually be redirecting to the insecure resource instead of over SSL, depending on your rewrite rules. So Craft wouldn't actually be serving your site over SSL because your rules would always say to rewrite the request to an insecure resource.</p>

<h2>SSL Certificate</h2>

<p>Browsers can do weird things if you your SSL cert is not installed correctly.  I like <a href="https://ssltools.websecurity.symantec.com/checker/views/certCheck.jsp">Symantec's SSL checker</a> for this sort of thing. If you're using domain based validation, like the regular comodo or geotrust certs, some of them require additional "chained" or intermediate certificates to work correctly. Besides checking your server config and certificate, that checker will also make sure the chain of trust is in the right "order". </p>

CC BY-SA 3.0
2015-06-11T08:01:40.063Z
Thanks for a really well explained answer. However, all three points seem to be correct. So I'm getting a green padlock in my browser on all resources (even on the login page itself (which means Chrome thinks it's a secure page, but Craft doesn't)). I have no rewrites in my htaccess, because it's on a sub domain, and the SSL is set up to work on that sub domain. Symantec's SSL checker verified that the certificate worked correctly. Here's the url to the login page, btw: https://prosjekt.hem.no/admin/login
peirix
CC BY-SA 3.0
2015-06-11T11:24:40.210Z
Okay, I have no idea what happened. But the problem is gone now, and everything works as expected. I hate it when things start working without me doing anything to change it. I'll just mark your answer as accepted, since I guess it'll help someone else later on.
peirix
CC BY-SA 3.0
2015-06-10T16:40:25.747Z
2015-06-10T16:40:25.747Z
RitterKnight
<p>I've set up a site with SSL, and finally got everything to load over https as well in the CP. But now I'm getting an error when trying to log in. When I look at the logs it says that the username cannot be blank. Which is weird, since I filled it out.</p>

<p>I'm also seeing the <code>insecure</code> symbol on the login button. But not sure why it's there.</p>

<login><https>
cp login over https gives error
# cp login over https gives error

(Asked by: username_0 on 2015-06-10)

I've set up a site with SSL, and finally got everything to load over https as well in the CP. But now I'm getting an error when trying to log in. When I look at the logs it says that the username cannot be blank. Which is weird, since I filled it out.

I'm also seeing the `insecure` symbol on the login button. But not sure why it's there.

**Tags:** login, https

---

## 1 answers

### Answer by username_1 on 2015-06-10. Score: 5 | Accepted answer

This could be a couple things:

* Server config
* .htaccess file
* SSL Certificate

But it sounds to me like the insecure login button means those assets are not being served over SSL. How'd you confirm the site is served over https?

Craft's control panel resources are not actually in the document root so what's happening is Craft's controller (index.php) is handling those would-be 404 requests and spitting out the cp resource in question from the backend via php.

## **Server Config**

If you can access a static file over https in the document root (say something like `https://yoursite.com/images/sitelogo.png` or your main CSS file) and your browser is showing the padlock and not an error, that means your virtual host is setup correctly.

That's the first thing I'd rule out. If you're not getting your browser's padlock on a simple request like that, your SSL setup needs tweaking, probably a bad virtual host config. For good measure, most certs allow www- and non www so check www.yoursite.com as well. (It's easy to forget to put in a `ServerAlias` in the VirtualHost block to handle both hostnames and then try to access the site and wonder what's going on, I've done it!)

## **.htaccess**

Another source of trouble could be if you have some additional rewrite rules in your .htaccess file. A common one is to rewrite from `www.sitename.com` to `sitename.com` or vice versa for example—that could actually be redirecting to the insecure resource instead of over SSL, depending on your rewrite rules. So Craft wouldn't actually be serving your site over SSL because your rules would always say to rewrite the request to an insecure resource.

## SSL Certificate

Browsers can do weird things if you your SSL cert is not installed correctly. I like [Symantec's SSL checker](https://ssltools.websecurity.symantec.com/checker/views/certCheck.jsp) for this sort of thing. If you're using domain based validation, like the regular comodo or geotrust certs, some of them require additional "chained" or intermediate certificates to work correctly. Besides checking your server config and certificate, that checker will also make sure the chain of trust is in the right "order".

> **Comments:**
> **username_0**: Thanks for a really well explained answer. However, all three points seem to be correct. So I'm getting a green padlock in my browser on all resources (even on the login page itself (which means Chrome thinks it's a secure page, but Craft doesn't)). I have no rewrites in my htaccess, because it's on a sub domain, and the SSL is set up to work on that sub domain. Symantec's SSL checker verified that the certificate worked correctly. Here's the url to the login page, btw: https://prosjekt.hem.no/admin/login  
> **username_0**: Okay, I have no idea what happened. But the problem is gone now, and everything works as expected. I hate it when things start working without me doing anything to change it. I'll just mark your answer as accepted, since I guess it'll help someone else later on.  

---

