Mixed content warnings after SSL problems

After TLS recovery, mixed content warnings mean pages still load active HTTP subresources—renew was step one; audit URLs is step two.

While certificates were expired, teams may have reverted pages to HTTP or CDNs served passive assets insecurely. Once HTTPS works again, browsers block active mixed content.

Some mixed content is a symptom of incomplete cleanup, not a new certificate issue—still fix TLS everywhere assets live.

First response

After TLS breaks and you recover, pages may still load active HTTP assets. Audit hardcoded http:// URLs and renew certificates so the page stays fully HTTPS again.

Search interest in mixed content ssl expired rises when the leaf notAfter on the hostname customers type is already in the past. Clients cannot rewrite server certificate dates; they only accept chains that pass PKIX checks at handshake time.

For Mixed content warnings after SSL problems, prove the failure from outside your office VPN before you change application code, purge caches, or ask end users to reboot. Capture the broken serial number and notAfter, renew on the listener that actually terminates that name, reload every node in the path, then re-run the same OpenSSL and browser checks that opened the incident.

Escalations for mixed-content-after-ssl-expiry should cite fresh openssl on HTML origin plus devtools mixed content audit output before anyone edits client code or blames Wi‑Fi. After TLS breaks and you recover, pages may still load active HTTP assets. Audit hardcoded http:// URLs and renew certificates so the page stays fully HTTPS again. When http:// assets after TLS was broken then partially fixed clusters around Browsers blocking active mixed content post-recovery, the expired material is usually bound to HTML still referencing legacy HTTP URLs instead of a mysterious platform bug. Executive summaries need the public hostname and current notAfter, not screenshots from a VPN-split test laptop.

See also Ecommerce checkout down due to SSL expiry and SMTP TLS certificate expired (STARTTLS).

What this error means

Browsers treat active mixed content (scripts, XHR) as blocking. Passive images over HTTP may warn but not block, confusing QA.

Expired cert periods sometimes push editors to hardcode http:// CDN links that linger after renewal.

Renew certs on all asset hosts, rewrite URLs to https://, and use CSP upgrade-insecure-requests during transition.

In PKIX terms, Browsers blocking active mixed content post-recovery treat the TLS Certificate message as authoritative: signatures must verify, each link must be within notBefore/notAfter, and only then does name matching run against CN and SAN. When the leaf expired, http:// assets after TLS was broken then partially fixed is expected even if the issuer is publicly trusted. Guides titled mixed content after ssl expiry still require reading dates on every certificate the server sends, including forgotten cross-sign intermediates.

Triage for mixed content after ssl expiry should reject quick myths: flushing DNS or rebooting laptops does not move server notAfter forward. It is not proof the whole internet is broken when other HTTPS sites load for Browsers blocking active mixed content post-recovery. It is not interchangeable with registrar billing lapses unless revalidation fails later. It is not fixed by turning off TLS at the load balancer while marketing keeps publishing https:// links. Validated externally, openssl on HTML origin plus devtools mixed content audit must show fresh dates on HTML still referencing legacy HTTP URLs before you close the incident.

Common causes

These patterns appear often during mixed content ssl expired incidents. They are not exhaustive, but they explain why renewal looked finished internally while strangers still received expired material.

Runbooks for mixed content after ssl expiry most often break at handoff: certbot or a vendor portal issued new certs, but HTML still referencing legacy HTTP URLs never received a reload. Teams tracked PEM files in git while production continued serving the previous listener binding. OV renewals waited on legal approvers until http:// assets after TLS was broken then partially fixed became customer-visible. Inventory spreadsheets omitted the hostname that Browsers blocking active mixed content post-recovery actually call during peak traffic.

Architecture amplifies mixed content after ssl expiry: multiple regions, canary pools, or blue/green deploys can leave one ASG member presenting yesterday's fullchain. Shared IP default certificates silently terminate vanity hostnames without dedicated SNI rules. Mounted TLS secrets updated on disk while Envoy or nginx workers kept the old chain until signaled. After TLS breaks and you recover, pages may still load active HTTP assets becomes harder to debug when only a fraction of Browsers blocking active mixed content post-recovery hit the stale anycast node.

Measurement gaps complete the story for mixed content after ssl expiry. Synthetic monitors that disable certificate verification greenlit deploys that fail for real Browsers blocking active mixed content post-recovery. Redirect maps hid which hop expired until operators ran openssl on HTML origin plus devtools mixed content audit per hostname. Dashboards celebrated TCP uptime while notAfter crossed midnight UTC without a page. Post-mortems should ask whether CT logs or stapled OCSP would have warned days earlier.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Check asset hostnames separately; they may expire on different schedules.

How to read the output

Start with openssl on HTML origin plus devtools mixed content audit against the live customer hostname, capturing the leaf presented after SNI selection. Interpret notBefore= and notAfter= first: past notAfter guarantees failure for http:// assets after TLS was broken then partially fixed regardless of pretty issuer branding. Next read subject= and any X509v3 Subject Alternative Name extension for alignment with the URL bar. Finally note issuer= so you know whether renewal changed intermediates; record serial numbers in the ticket for post-deploy diffing.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

curl -I asset URLs to confirm HTTPS status codes.

Browser spot-check

DevTools Console lists blocked mixed content with exact URLs.

Fix checklist

Work this list in order for mixed content warnings after ssl problems. Each step should produce evidence (command output, timestamps, serial numbers) you can paste into the incident ticket.

1. Renew certificates on CDN and origin asset hosts.
2. Search CMS for http:// hardcodes.
3. Update site maps and email templates to HTTPS links.
4. Enable CSP helpers where safe.
5. Purge CDN caches after URL rewrites.
6. Retest checkout and login with console open.
7. Scan third-party widgets for legacy HTTP.
8. Monitor mixed-content reports if enabled.

Roll out and verify

Procurement for mixed content after ssl expiry begins with a reissue that lists every hostname Browsers blocking active mixed content post-recovery need, including forgotten admin and callback URLs. Validate CSR/key pairs, download CA bundles, and schedule work on HTML still referencing legacy HTTP URLs during a staffed change window. If automation handles ACME, prove challenges use the same DNS names customers resolve publicly, not internal-only labels.

Installation for mixed content after ssl expiry means concatenating leaf and required intermediates the way your stack documents, then touching every node that terminates the name. Reload web servers, recycle ingress pods, or update cloud listener objects so data planes read new bytes. For load balancers, sync default and per-host certificates so SNI cannot fall back to expired defaults. Repeat openssl on HTML origin plus devtools mixed content audit until fingerprints or serials change everywhere responders tested earlier.

Verification for mixed content after ssl expiry must mimic strangers: external synthetics, mobile carriers, and CI jobs without corporate trust roots. Confirm http:// assets after TLS was broken then partially fixed disappeared for Browsers blocking active mixed content post-recovery on flows heavier than GET /. Restore any strict TLS, HSTS, or CDN SSL modes relaxed during firefighting. Feed the hostname into continuous notAfter monitoring with thresholds well before the next CA-enforced renewal cliff.

What to automate

Certificate files on disk lie. Automate live TLS checks on the exact hostname and port users hit, including redirects and the certificate presented after TLS terminates on a load balancer or CDN. Pair certificate notAfter with RDAP domain registration expiry so re-validation is not blocked by a lapsed registrar.

Lint HTML templates for insecure asset URLs after renewals. Schedule alerts at 30, 14, 7, and 1 day before expiry so on-call has runway for ACME failures, manual OV revalidation, or change windows. Services such as ssldays can run external checks and renewal reminders without replacing your CA workflow.