Google Chrome: AutoHotkey.com not secure

[jballi]

Google Chrome appears to be getting more forceful about their security warnings in 2017. I'm now getting a "Not secure" notice on the URL line along with a "!" icon on every AutoHotkey.com page. When I check the error, I find the following: Your connection to this site is not secure. You should not enter any sensitive information on this site (like passwords or credit cards) because it... When pressed for more details, Chrome informs me that the server is using a SHA-1 Certificate. The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1.

Apparently Chrome does not like the SHA-1 Certificate.

This is not a new warning. This type of warning has been going on for almost a year. It has just become a little more prominent in a recent release of Chrome. Well, at least for me.

This warning appears to only occur in Chrome. I don't see it in FireFox or IE.

[joedf]

I know we're supposed to switch over to LetsEncrypt at one point. Maybe once this runs out?
It works fine on Vivaldi v1.6.689.40 (Chrome/55.0.2883.98).

[tank]

First of all, You should never enter sensitive information on this site .... ever.
It is only my intent to provide reasonable protection that we can aquire for free. it isnt top notch and it is lets encrypt already. but we have a free cloudflare waf on top of it which is actually the lesser of the 2 encryptions and the cause of SHA1 problem

[joedf]

Oh..... that's why I can see the letsencrypt files on the server but on my browser connection...

[lmstearn]

The issuing authority for the cert is 404
The same goes for the the MS IT SSLSHA2 cert expiring Dec this year.
As for the other insecure messages:

Spoiler

viewtopic.php?f=3&t=26488:472 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... edhelp.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:472 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... dation.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:472 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... icense.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:472 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... npeace.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:472 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... script.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:590 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... edhelp.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:590 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... dation.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:590 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... icense.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:590 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... npeace.gif'. This content should also be served over HTTPS.
viewtopic.php?f=3&t=26488:590 Mixed Content: The page at 'https://autohotkey.com/boards/viewtopic.php?f=3&t=26488' was loaded over HTTPS, but requested an insecure image 'http://joedf.ahkscript.org/assets/img/u ... script.gif'. This content should also be served over HTTPS.

Wonder if it would issue the same warnings if they were all bmps?

[tank]

Only think i see is the mixed content. kinda strange. wonder if the 404 has to do with something about your locale

[joedf]

Yeah, my signature... :b
Updated.