Environment

• Confluence running behind Apache
• SSL enabled on Confluence
• Confluence loads at https://...

Symptoms

• Between login and Confluence dashboard, warning messages pop up
• Confluence presents "insecure content" warnings to users even though Confluence is running over SSL

Diagnosis

Custom authentication is being used. Shibboleth, in this example.

Cause

There are missing configuration settings in the shib.conf file.

Resolution

• Add ShibRedirectToSSL 443 configuration settings to shib.conf. Similar to:

  <Location /<context-path-here if necessary>>
  AuthType shibboleth
  ShibUseEnvironment On
  ShibUseHEaders On
  ShibRequestSetting requireSession 1
  require shibboleth
  ShibRedirectToSSL 443
  </Location>