we are using the google search appliance in our web app. It is used by several other parts of our organization but we are using it on a web app that uses https. So, we followed google's instructions to get all the google code via https so that users don't get the annoying "This page contains both secure and insecure items" popup. Most of the google code has behaved and come to us as https, but there is a part of it pulling from http://www.google.com/cse full URL =


that causes the insecure items warning to popup.
This popup occurs in the results page and the above URL is the only non-secure request I can find.

Update. It turns out we didn't follow a specific Google doc to make this happen, but instead a series of forum posts. Most recently we are trying to follow this one: http://www.google.com/support/forum/p/webelements/thread?tid=64ebdf5fd3839c2d&hl=en

Reviewing these, I think that serving our entire site through https and using Google's custom search with javascript is not possible at this time.
and since we have paid for a custom search from google, there should be a way to change to non-javascript version. Is this correct?

  • Could you post a link to google's instructions to get all the code via https? Can you post how you followed these instructions?
    – Daisetsu
    Feb 10, 2011 at 19:01
  • Also, your question is not question at all. Maybe you should state clearer what is the solution you are trying to achieve. Getting everything over HTTPS?
    – Olli
    Feb 10, 2011 at 19:06
  • Thanks for your replies. I have updated the original post. Olli, the goal is to serve our entire site through https and not have the insecure items popup because of google's javascript.
    – mcgyver5
    Feb 11, 2011 at 14:57

1 Answer 1


Since this question was asked, Google has started to support JavaScript custom search for HTTPS sites. From https://developers.google.com/custom-search/docs/js/cselement-devguide (emphasis added):

This example specifies that the JavaScript code for the custom search element can be found at http://www.google.com/jsapi. If you specify a different local Google host (for example, <script src="http://www.google.co.uk/jsapi" type="text/javascript">), that host will also be used in Google search. To avoid mixed content security warnings, you can also specify https:// instead of http:// if necessary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.