Found it: you were right. I had a long forgotten mod_rewrite in httpd.conf for LocationMatch "*upload*" -> https. My bad .

Thanks for your help, much appreciated!

So the page just loads completely over http? No SSL whatsoever?

Garvin, thanks for your reply. The links inserted (and causing the trouble) reference to an uploaded thumbnail, so I only have relative paths there.

First, thumbs up, great weblog software.

I run serendipity over HTTP. After enabling HTTPS for administration, the frontpage is loaded over HTTP, except the thumbnails. They are loaded over HTTPS for some reason, which leads to ugly SSL warnings due to self-signed certificates.

GET requests for ...