title: HTTPS Issue - When running Java application some users get SEC7111
body: <p>We have set up a website with a secure certificate (signed by VeriSign) which works fine for most users, however all users in company X cannot access it without error. When accessing the site, the users are presented with an HTML page that appears to be completely unstyled (i.e. the CSS didn't load) and the browser console reports the following:</p>
  
  <pre><code>SEC7111: HTTPS security is compromised by http://&lt;ipaddress&gt;:15871/cgi-bin/blockpage.cgi?ws-session=&lt;a session id&gt;
  </code></pre>
  
  <p>This does not affect any other users in OTHER companies (so far!) but we are determined to find out what the cause is. </p>
  
  <p>I assumed that the error is stating that an HTTP request is being attempted from our HTTPS site, but I searched the codebase and can't find anything.</p>
  
  <p>Our Java Web Application runs on an Apache Tomcat (version 7) and uses JSPs. All assets are referenced in the following manner:</p>
  
  <p>Top of a JSP page:</p>
  
  <pre><code>&lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%&gt;
  &lt;c:set value="${pageContext.request.contextPath}" var="baseUrl" /&gt;
  </code></pre>
  
  <p>Reference to an asset:</p>
  
  <pre><code>&lt;link rel="stylesheet" href="${baseUrl}/assets/css/bootstrap.css"/&gt;
  </code></pre>
  
  <p>We did change the c:set value to be hard-coded to the URL but that made no difference. The users still got the SEC7111. For clarity the following is what we changed the c:set value to:</p>
  
  <pre><code>&lt;c:set value="https://thewebsite" var="baseUrl" /&gt;
  </code></pre>
  
  <p>On my machine using Firebug I can see that all requests to the assets on the site are going over https there are no http calls.</p>
  
  <p>There is also an Apache server in front of our Apache Tomcat redirecting all http requests to https :</p>
  
  <pre><code>Redirect permanent / https://&lt;our website&gt;/
  </code></pre>
  
  <p>And in the virtualhost *:433 section</p>
  
  <pre><code>ProxyPass        / http://local host:8295/
  ProxyPassReverse / http://local host:8295/
  </code></pre>
  
  <p>Please note that the ProxyPass and ProxyPassReverse above are indeed HTTP! This (in my mind) is intentional. Once a connection has been made to the site (<a href="https://thewebsite.org" rel="nofollow">https://thewebsite.org</a>) then the calls behind (to localhost) can be http. I think this is legitimate.</p>
  
  <p>If anyone can point out what I am doing wrong or suggest any avenues I should look at then please get in touch! Thanks! </p>