This could be a couple things:
- Server config
- .htaccess file
- SSL Certificate
But it sounds to me like the insecure login button means those assets are not being served over SSL. How'd you confirm the site is served over https?
Craft's control panel resources are not actually in the document root so what's happening is Craft's controller (index.php) is handling those would-be 404 requests and spitting out the cp resource in question from the backend via php.
If you can access a static file over https in the document root (say something like
https://yoursite.com/images/sitelogo.png or your main CSS file) and your browser is showing the padlock and not an error, that means your virtual host is setup correctly.
That's the first thing I'd rule out. If you're not getting your browser's padlock on a simple request like that, your SSL setup needs tweaking, probably a bad virtual host config. For good measure, most certs allow www- and non www so check www.yoursite.com as well. (It's easy to forget to put in a
ServerAlias in the VirtualHost block to handle both hostnames and then try to access the site and wonder what's going on, I've done it!)
Another source of trouble could be if you have some additional rewrite rules in your .htaccess file. A common one is to rewrite from
sitename.com or vice versa for example—that could actually be redirecting to the insecure resource instead of over SSL, depending on your rewrite rules. So Craft wouldn't actually be serving your site over SSL because your rules would always say to rewrite the request to an insecure resource.
Browsers can do weird things if you your SSL cert is not installed correctly. I like Symantec's SSL checker for this sort of thing. If you're using domain based validation, like the regular comodo or geotrust certs, some of them require additional "chained" or intermediate certificates to work correctly. Besides checking your server config and certificate, that checker will also make sure the chain of trust is in the right "order".