What Safari Shows
When a Safari user visits a Google Cloud URL, a security icon or warning can appear, indicating mixed content or an insecure TLS handshake. The browser interprets certain elements on the page as not meeting its security thresholds.
More from this site
Keep reading the latest coverage
Root Causes
Mixed Content
Google Cloud hosts static assets over HTTP on some legacy endpoints. If a page loads those assets while the main connection is HTTPS, Safari flags the page as partially insecure.
Outdated TLS Protocols
Older TLS versions (1.0, 1.1) are disabled in recent Safari releases. If a Google Cloud endpoint still negotiates with these protocols, the browser refuses the connection or marks it as weak.
Strict HSTS Policy
Safari enforces HTTP Strict Transport Security aggressively. If a redirect chain drops HSTS headers or a sub‑domain is missing them, Safari may downgrade the security level.
Certificate Issues
Google Cloud's certificates are issued by a trusted CA, but intermediate chains must be complete. A missing intermediate cert can trigger Safari's warning even though the root is valid.
Impact on Users
Safari's warnings do not mean Google Cloud is insecure; they signal that the browser cannot fully verify the connection's integrity under its current settings. Users may still access content, but the warning can deter trust and affect engagement.
How to Resolve the Issue
- Ensure all assets are served over HTTPS, removing any legacy HTTP URLs.
- Configure TLS 1.2 and 1.3 only on Google Cloud load balancers and backend services.
- Implement and maintain HSTS headers for all sub‑domains.
- Verify the full certificate chain with tools like SSL Labs.