I am currently testing a website for a new application. Currently the SSL is being performed on the load balancer (SSL offloading, talking unencrypted to the back end web server) and it is securing the entire site. so anyone going to http://www.mytestsite.com gets redirected to https://www.mytestsite.com
When using the application some users are experiencing some pages displaying an IE warning that the page requested references some insecure links. Now my thinking is this is happening becuase the load balancer secures the connection between the client and the load balancer, and it is securing pages served up by the web server, however if these webpages contain links within their code to unsecured content (i.e. an image contained on another server) the load balancer is not responsible to adjusting this link within the code and this is what IE is referencing in its warning message (as IE does not know it will be redirected by the load balancer when retrieving this content).
Does this sound correct? or do I sound way off?
for the solution I am proposing the webserver itself determine which content should be secured (still allowing the load balancer to secure it) as it may be content that does not need to be secured, or have the links reference https connections.
