如何识别https网站中的混合内容
我继承了一个 ASP.NET 网站，该网站具有通过 GoDaddy 购买的 SSL 证书。
问题是证书似乎无效，因为一些来自 http 站点的“混合内容/资源”（我认为这就是它的称呼）。
Chrome 在 https 旁边的锁上显示红十字，这意味着它不安全。弹出窗口显示以下内容：
单击“这些是什么意思？” 此处显示：
当出现[十字锁]图标时，会出现 Google Chrome 检测到高风险混合 内容，例如 JavaScript， 页面或当网站呈现 证书无效。
该证书是正确且有效的，因为我尝试创建一个空白的“Hi world”.aspx 页面，并且它显示绿色锁，没有任何问题。
读了一下，我发现我应该只包含来自 https 站点的图像和 javascript。它来自http的唯一东西是addthis小部件，但是它们支持https，所以我改变了到 https，但它仍然说不安全。
我在源代码中搜索了来自 http 的其他内容，但没有找到任何内容。
是否有某种方法（网站、chrome 扩展、firefox 扩展等）可以准确显示哪些资源是“不安全”的？
我从未处理过 SSL/HTTPS 证书，但我需要尽快解决这个问题。
I've inherited an ASP.NET web site that has an SSL certificate bought via GoDaddy.
The problem is that the certificate seems to be invalid because of some "mixed content/resources" (I think that's how its called) coming from http sites.
Chrome is showing the red cross over the lock next to https, meaning it's unsecured. The popups says the following:
Click in "What do these mean?" goes here which says:
The [crossed-lock] icon appears when
Google Chrome detects high-risk mixed
content, such as JavaScript, on the
page or when the site presents an
invalid certificate.
The certificate is correct and valid because I tried creating a blank "Hi world" .aspx page and it's showing the green lock with no problems.
Reading a little bit, I found that I should only include images and javascript coming from https sites. The only thing it had coming from http was the addthis widget, but they support https, so I changed to https, but it's still saying that is unsecured.
I've searched for anything else coming from http in the source, but didn't find anything.
Is there some way (site, chrome extension, firefox extension, whatever) that will show exactly which are the resources that are "unsecured"?
I've never dealt with SSL/HTTPS certificates, but I need to fix this issue asap.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
检查您的网站 http://www.whynopadlock.com，这将为您提供一个您认为不安全的网址列表浏览器。
Check your site in http://www.whynopadlock.com, which will give you a list of url which is not consider as secure by your browser.
检查 chrome 控制台，
你会得到这样的结果，
将 http 站点设置为 https，然后它就可以工作了。
Check the chrome console
You will get it like this,
Make it http site to https then it will work.
我使用 Chrome 开发者工具发现了该问题。这是一个嵌入来自使用 http 的第 3 方网站的 Flash 的 js。
I've found the problem using the Chrome Developer Tools. It was a js that's embedding a flash from an 3rd party site which it's using http.
你用的是Windows吗？在浏览站点时下载并运行 Fiddler，并监视 HTTP 连接。
Are you on Windows? Download and run Fiddler while browsing the site, and watch for HTTP connections.
混合内容是指网页内容与 HTTP 和 HTTPS 链接混合。
这些链接包括您的 JS、CSS、图像、视频、音频、Iframe 等。
如果您的网站启用了 HTTPS（已安装 SSL 证书），请确保您在整个网页中仅提供 HTTPS 内容。
Mixed content means contents of a web page are mixed with HTTP and HTTPS links.
These links include your JS, CSS, Image, Video, Audio, Iframes etc.
If your website is enabled for HTTPS (SSL certificate has installed), make sure you serve only HTTPS contents throughout your web page.