# Links to Amazon cause a TLS mixed content warning
**URL:** https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743
**Category:** Bug
**Created:** [January 11, 2016, 2:22pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743 "2016-01-11T14:22:47Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@vks](https://meta.discourse.org/u/vks)
#### Post date: [January 11, 2016, 2:22pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/1 "2016-01-11T14:22:47Z")
Linking to Amazon in a topic causes a mixed content warning when using https, presumably because the thumbnail is loaded from a third party over http.
Would it be possible to load the thumbnail using https instead?
---
### Author:  [@wesochuck](https://meta.discourse.org/u/wesochuck)
#### Post date: [January 11, 2016, 2:47pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/2 "2016-01-11T14:47:52Z")
Do you have a public forum? If so, can you provide a link to an article that displays the TLS mixed content issue?
I assume you’re using Amazon for your CDN? Or are you hosting your entire instance out there?
---
### Author:  [@vks](https://meta.discourse.org/u/vks)
#### Post date: [January 11, 2016, 3:44pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/3 "2016-01-11T15:44:51Z")
Unfortunately the forum is not public. I’m not using Amazon for hosting, I get this is issue when linking to a book on Amazon, like this:
> **[The Art of Computer Programming, Volumes 1-4A Boxed Set: 9780321751041: Computer...](https://www.amazon.com/Computer-Programming-Volumes-1-4A-Boxed/dp/0321751043)**
>
> The Art of Computer Programming, Volumes 1-4A Boxed Set: 9780321751041: Computer Science Books @ Amazon.com
Now you should get a warning when reading this topic, if you click at the place where normally the padlock is.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [January 11, 2016, 4:04pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/4 "2016-01-11T16:04:05Z")
This is a known problem.
[https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103/21?u=gerhard](https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103/21)
---
### Author:  [@wesochuck](https://meta.discourse.org/u/wesochuck)
#### Post date: [January 11, 2016, 4:06pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/5 "2016-01-11T16:06:55Z")
Ahh, this is a oneboxing issue then and I don’t think there is an easy fix.
For example if you go to: [The Art of Computer Programming, Volumes 1-4A Boxed Set: 9780321751041: Computer Science Books @ Amazon.com](https://www.amazon.com/gp/product/0321751043?amp%3Bkeywords=art%20of%20programming&%3Bqid=1452526990&%3Bsr=8-1&ref_=sr_1_1)
You’ll notice that it redirects to you HTTP, so I would say that site-wide HTTPS is not possible with Amazon at the moment. Which means the oneboxing code wouldn’t be able to pull in the HTTPS data from Amazon when your page loads.
One work-around is to use the method here:
[https://meta.discourse.org/t/dont-load-http-images-when-using-https/27530/4](https://meta.discourse.org/t/dont-load-http-images-when-using-https/27530/4)
That thread references a feature request to store the images locally instead of pulling them “in real time” from the oneboxed site:
[https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103?u=gerhard](https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103)
---
### Author:  [@vks](https://meta.discourse.org/u/vks)
#### Post date: [January 11, 2016, 4:24pm UTC](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/6 "2016-01-11T16:24:20Z")
> [@wesochuck](#):
>
> One work-around is to use the method here: […]
This is not really a workaround, because it is not enforceable. A workaround would be disabling oneboxes for non-https content.