I've set up a site with SSL, and finally got everything to load over https as well in the CP. But now I'm getting an error when trying to log in. When I look at the logs it says that the username cannot be blank. Which is weird, since I filled it out.

I'm also seeing the insecure symbol on the login button. But not sure why it's there.

1 Answer 1


This could be a couple things:

  • Server config
  • .htaccess file
  • SSL Certificate

But it sounds to me like the insecure login button means those assets are not being served over SSL. How'd you confirm the site is served over https?

Craft's control panel resources are not actually in the document root so what's happening is Craft's controller (index.php) is handling those would-be 404 requests and spitting out the cp resource in question from the backend via php.

Server Config

If you can access a static file over https in the document root (say something like https://yoursite.com/images/sitelogo.png or your main CSS file) and your browser is showing the padlock and not an error, that means your virtual host is setup correctly.

That's the first thing I'd rule out. If you're not getting your browser's padlock on a simple request like that, your SSL setup needs tweaking, probably a bad virtual host config. For good measure, most certs allow www- and non www so check www.yoursite.com as well. (It's easy to forget to put in a ServerAlias in the VirtualHost block to handle both hostnames and then try to access the site and wonder what's going on, I've done it!)


Another source of trouble could be if you have some additional rewrite rules in your .htaccess file. A common one is to rewrite from www.sitename.com to sitename.com or vice versa for example—that could actually be redirecting to the insecure resource instead of over SSL, depending on your rewrite rules. So Craft wouldn't actually be serving your site over SSL because your rules would always say to rewrite the request to an insecure resource.

SSL Certificate

Browsers can do weird things if you your SSL cert is not installed correctly. I like Symantec's SSL checker for this sort of thing. If you're using domain based validation, like the regular comodo or geotrust certs, some of them require additional "chained" or intermediate certificates to work correctly. Besides checking your server config and certificate, that checker will also make sure the chain of trust is in the right "order".

  • Thanks for a really well explained answer. However, all three points seem to be correct. So I'm getting a green padlock in my browser on all resources (even on the login page itself (which means Chrome thinks it's a secure page, but Craft doesn't)). I have no rewrites in my htaccess, because it's on a sub domain, and the SSL is set up to work on that sub domain. Symantec's SSL checker verified that the certificate worked correctly. Here's the url to the login page, btw: prosjekt.hem.no/admin/login
    – peirix
    Jun 11, 2015 at 8:01
  • Okay, I have no idea what happened. But the problem is gone now, and everything works as expected. I hate it when things start working without me doing anything to change it. I'll just mark your answer as accepted, since I guess it'll help someone else later on.
    – peirix
    Jun 11, 2015 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.