Ssl – Allow active mixed content (iframes) with SSL and Content Security Policies

httpsmixed-contentssl

I've installed a SSL certificate on my server, and I've made it HTTPS. But I need to load existent iframes with embedded content, usually YouTube videos that were saved with HTTP url, but also other content that is not available via HTTPS.

upgrade-insecure-requests is not a suitable solution, since it blocks the passive content if it can't be retrieved with HTTPS, which without defining Content-Security-Policyis not blocked by browsers.

Which policy do I have to define to make the browser not block the active content?

Best Answer

You can't disable the mixed security check at site level. If browser would allow it, this behavior will provide a false sense of security and defeat the trust on the use of HTTPS.

Some browsers allow the setting to be disabled on per-installation basis. For example, you can disable the check in Firefox by changing the setting

security.mixed_content.block_active_content

in about:config.

Chrome doesn't allow it explicitly, and the only way is to click on load anyway. It is also worth to mention that newer versions of Chrome no longer display a crossed padlock, instead Chrome will essentially downgrade the security of the page to HTTP if you load any HTTP content.

Explanation

You obviously bought your certificate at RapidSSL. RapidSSL though is not one of the CAs that your browsers trust. This is no problem because your browser trusts GeoTrust and GeoTrust trusts RapidSSL. You just have to show the browser the certificate that proves this. That is why you need to include the chain file.

Ssl – Mixed Content and SSL Sites / Protocol Relative URLs

All content needs to be served through HTTPS to avoid warnings. What good would SSL do if an attacker could still do a MITM attack and alter say, the jquery js you are loading? They could still change everything through javascript.

So your options are:

Move/copy everything to the same domain. By moving the files, or reverse proxy, or other tricks.
Get seperate SSL certs for each domain (which also often means seperate IP addresses if they are on the same server)
Get a SAN (Subject Alternate Name) certificate. This allows you to have one cert that covers several specified domains and/or subdomains. How many domains depends on the provider and how much you pay. They can often be combined with wildcards to cover all subdomains.

Best Answer

Related Solutions

Ssl – Wildcard SSL behaves inconsistently across browsers / OS’s / computers

Explanation

Ssl – Mixed Content and SSL Sites / Protocol Relative URLs

Related Topic