# Mixed Content/Invalid Certificate errors **URL:** \ **Category:** Transloadit\ **Tags:** tender-archive\ **Created:** [November 28, 2013, 1:51am UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225 "2013-11-28T01:51:00Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Cayley](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@Cayley](https://community.transloadit.com/u/Cayley)\ **Post date:** [November 28, 2013, 1:51am UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/1 "2013-11-28T01:51:00Z")
> Archived from the Transloadit support forum. Originally posted on November 28, 2013; details may be outdated, see [our docs](https://transloadit.com/docs/) for current behavior. [Original thread](https://web.archive.org/web/20140430041439/http://support.transloadit.com/discussions/problems/12217-mixed-contentinvalid-certificate-errors) I’m uploading files from a web app served via https. The client uploads the file, then pings the assembly url to determine when the upload is complete before updating it’s display. The GET requests to find out when the assembly has finished processing were failing with the error “Blocked loading mixed active content” on Firefox because the assembly url was http not https. However, changing the url to be https causes Safari to fail with an “Invalid certificate” error. Any help would be appreciated. ---
**Author:** ![Francisco\_Azevedo](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/francisco_azevedo/32/1632_2.png) [@Francisco\_Azevedo](https://community.transloadit.com/u/Francisco_Azevedo)\ **Post date:** [November 28, 2013, 1:47pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/2 "2013-11-28T13:47:00Z")
Hi Cayley, There’s already a feature request ( [https://community.transloadit.com/t/external\_id/tender-questions-8136](https://community.transloadit.com/t/external%5Fid/tender-questions-8136) ) to add url\_ssl in assembly result so that, when we are in a https page we use the ssl version of url. As workaround you can convert the result url to https version by changing: [http://tmp.transloadit.com.s3.amazonaws.com/](http://tmp.transloadit.com.s3.amazonaws.com/)… to [https://s3.amazonaws.com/tmp.transloadit.com/](https://s3.amazonaws.com/tmp.transloadit.com/)… best, Francisco Azevedo ---
**Author:** ![tim-kos](https://avatars.discourse-cdn.com/v4/letter/t/bbe5ce/32.png) [@tim-kos](https://community.transloadit.com/u/tim-kos)\ **Post date:** [November 28, 2013, 3:09pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/3 "2013-11-28T15:09:00Z")
Hey Cayley, Francisco is right, we have already added this to our todo. We should have this ready by the end of the year hopefully. In the meantime you can use the workaround that Francisco provided. Thank you, Francisco. Kind regards, Tim Co-Founder Transloadit @tim\_kos ---
**Author:** ![Cayley](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@Cayley](https://community.transloadit.com/u/Cayley)\ **Post date:** [November 28, 2013, 4:57pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/4 "2013-11-28T16:57:00Z")
I think there is some miscommunication: I was referring to the Assembly status route (section 3.2 in the docs: {assembly\_url}?signature={signature}), not the links to the temporary files on AWS. ---
**Author:** ![tim-kos](https://avatars.discourse-cdn.com/v4/letter/t/bbe5ce/32.png) [@tim-kos](https://community.transloadit.com/u/tim-kos)\ **Post date:** [November 28, 2013, 7:22pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/5 "2013-11-28T19:22:00Z")
Ah okay, sorry about that. Which client are you using? Are you using the jQuery plugin? ---
**Author:** ![Cayley](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@Cayley](https://community.transloadit.com/u/Cayley)\ **Post date:** [November 28, 2013, 8:03pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/6 "2013-11-28T20:03:00Z")
I’m using a custom client based on [https://github.com/tim-kos/transloadit\_xhr](https://github.com/tim-kos/transloadit%5Fxhr). I’m also testing on a server using a self-signed cert and I’m not familiar enough with how SSL signing works to know if this would cause the problem (ie. you’re cert’s authorities don’t match mine or something), so any advice there would be appreciated. The exact error I see in the browser console is “Failed to load resource: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “[api2.rahimah.transloadit.com](http://api2.rahimah.transloadit.com)” which could put your confidential information at risk.” ---
**Author:** ![Ryan\_Schmukler](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/ryan_schmukler/32/1641_2.png) [@Ryan\_Schmukler](https://community.transloadit.com/u/Ryan_Schmukler)\ **Post date:** [November 29, 2013, 4:16am UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/7 "2013-11-29T04:16:00Z")
+1 I am running into the cert issue even when manually converting the http to https. This breaks transloadit on Firefox 23+ and Internet Explorer 10+. Any help would be greatly appreciated! ---
**Author:** ![kvz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/kvz/32/606_2.png) [@kvz](https://community.transloadit.com/u/kvz)\ **Post date:** [November 30, 2013, 1:35pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/8 "2013-11-30T13:35:00Z")
Hello, One note about the (e.g.) rahima waring, our certificate only allows subdomains 1 level deep. Meaning that [api2.rahimah.transloadit.com](http://api2.rahimah.transloadit.com) will result in certificate warnings. This is why we have made [rahimah.transloadit.com](http://rahimah.transloadit.com) point to api2 by default so you can still have warning-free api2 communication via [https://rahimah.transloadit.com](https://rahimah.transloadit.com). We’ll review how we can best automate this for our customers so there’s no hackery involved anymore. (e.g. providing an `assembly_ssl_url` that coexists next to the `assembly_url` and doing something similar for our tmp files). Hope this helps, Kevin ---
**Author:** ![Ryan\_Schmukler](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/ryan_schmukler/32/1641_2.png) [@Ryan\_Schmukler](https://community.transloadit.com/u/Ryan_Schmukler)\ **Post date:** [November 30, 2013, 6:21pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/9 "2013-11-30T18:21:00Z")
Kevin, Thanks for the tip. I was able to hack it with the following regex: var url = assemblyUrl .replace(/http:\/\//, 'https://'😉 .replace(/api2.\w+/, ‘rahimah’); Like I said, the mixed-content (communicating via http in XHR on a page loaded with https) is blocked in Firefox 23+ and IE10+ so that’s quite a hit. ---
**Author:** ![kvz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/kvz/32/606_2.png) [@kvz](https://community.transloadit.com/u/kvz)\ **Post date:** [December 10, 2013, 10:09am UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/10 "2013-12-10T10:09:00Z")
Hi everybody, Just to to be sure and to close this ticket, we’ve made `ssl_url` properties available for both api endpoints as tmp files. Hope this helps, Kevin ---
**Author:** ![Ryan\_Schmukler](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/ryan_schmukler/32/1641_2.png) [@Ryan\_Schmukler](https://community.transloadit.com/u/Ryan_Schmukler)\ **Post date:** [December 10, 2013, 3:50pm UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/11 "2013-12-10T15:50:00Z")
Kevin, Awesome to hear! You guys rock and I love transloadit! Best, Ryan ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex032/uploads/transloadit/original/1X/04ee57da0cb7ac8728a9ac5965c288164f4ce280.svg) [@system](https://community.transloadit.com/u/system)\ **Post date:** [October 7, 2026, 10:37am UTC](https://community.transloadit.com/t/mixed-content-invalid-certificate-errors/18225/12 "2026-10-07T10:37:51Z")