Insecure connection with Chrome browser, wrong settings?

[01Kuzma]

Hello!
I have a question regarding security settings. As I wrote earlier, I upgraded from October CMS some time ago to Winter CMS, there were some minor bugs that I already have reported.

I've some weird behaviour. probably not everything was upgraded properly:
On a localhost, Firefox, (Laragon, Windows) the connection is not always secure (previously it was, probably, I have changed something). But at this moment it is not secured. On a Chrome it was always insecure.

On a live version Firefox reports that my website is secure with a Let's Encrypt certificate (it's created it on my hosting)
BUT, Chrome refuses to maintain a secure connection, it writes, that it is insecure.

I have already changed the Linking policy: 'linkPolicy' => 'secure', , but this did not solve the issue with Chrome.

Are there any options or tricks left, which I might have missed?

Or it's more related to forcing the https through a .htaccess?

[mjauvin]

Can you share the url of the website ?

[01Kuzma]

Yes, it's filmustudija.lt

[damsfx]

@01Kuzma You can always ensure that your SSL certificate is valid with a SSL checker like https://www.sslchecker.com/sslchecker

[01Kuzma]

@01Kuzma You can always ensure that your SSL certificate is valid with a SSL checker like https://www.sslchecker.com/sslchecker

Well, it writes, that SSL is not trusted , but on the same hosting other websites (Joomla CMS) run without this issue

[mjauvin]

Chrome shows it secure for me:

…

On Wed, Aug 30, 2023 at 12:51 PM 01Kuzma ***@***.***> wrote: Yes, it's filmustudija.lt <http://url> — Reply to this email directly, view it on GitHub <#965 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAPLTPXMUJDGHZOL4547WITXX5VQBANCNFSM6AAAAAA4EZEOEE> . You are receiving this because you commented.Message ID: ***@***.***>

-- Marc

[mjauvin]

Your problem is that http does not auto-redirect to https, that's it.

That needs to be done in your virtual host config or in .htaccess, nothing to do with winter.

[01Kuzma]

Chrome shows it secure for me:
That's strange :/

That needs to be done in your virtual host config or in .htaccess, nothing to do with winter.
Any suggestions for Winter .htaccess config or it should be common rules?

[mjauvin]

It should be in there already as a comment:

# RewriteCond %{HTTPS} off
# RewriteRule (.*) https://%{SERVER_NAME}/$1 [L,R=301]

[01Kuzma]

Thank you!
It seems, that now it's working!

[mjauvin]

Yup!

$ curl -I http://filmustudija.lt

HTTP/1.1 301 Moved Permanently
Date: Wed, 30 Aug 2023 17:21:37 GMT
Server: Apache
Location: https://filmustudija.lt/
Cache-Control: max-age=0
Expires: Wed, 30 Aug 2023 17:21:37 GMT
Content-Type: text/html; charset=iso-8859-1