<p>After much head scratching it wasn't an SSL issue. Litespeed had recently been installed on the shared server but was misconfigured.</p>

<blockquote>
  <p>It appears the allowed header size default value was modified during
  the installation of LiteSpeed which caused the issue. We've now
  restored the default value and the functionality of the website
  appears to have come back.</p>
</blockquote>

CC BY-SA 4.0
2019-07-05T14:43:34.670Z
2019-07-05T14:43:34.670Z
Dr_Codswallop
<p>I have a Craft 3 site that's been running on a production server. Recently we switched over to https but this has caused issues in the CP (multiple 'An unknown error occurred' red flags, can't view any of the individual entries or assets, CP utilities like clearing the cache tasks don't run).</p>

<p>Trying to debug it, this seems to largely resolve itself if I set <code>enableCSRF =&gt; false</code> in <code>config/general</code>. I can then use the CP to see &amp; edit my entries &amp; assets (although I still get an unknown error flag on the dashboard where the console shows a 400 error <code>get-feed-items</code> for the Craft News widget).</p>

<p>So seems to be related to the enableCSRF config setting. Whenever set it to <code>true</code> I get the <code>error 400</code> items in the console. I've cleared the browser cache multiple times but that doesn't fix it. I've cleared the Craft cache via the cp (but had to set CSRF to false again otherwise the script doesn't run and gives the 400 error again). Lastly I've manually nuked the <code>cpresources</code> folder in order for it to rebuild.</p>

<p><a href="https://i.sstatic.net/Y2m7l.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Y2m7l.jpg" alt="example of cp error"></a></p>

<p>Web dev isn't my strong point so looking for suggestions so I can try and understand what's going on and what to try next.</p>

CC BY-SA 4.0
2019-06-19T19:27:44.267Z
Have you tried clearing your browser's cookies as well? CSRF tokens are stored in cookies and you might have an old non-SSL one set locally.
Brad Bell
CC BY-SA 4.0
2019-06-19T21:46:32.727Z
Hi Brad, I've cleared the cookies a few times and tried loading the cp through a new incognito window but still the same error. Also manually cleared the craft sessions db table but still same problem. Seems to be any cp pages requiring ajax calls, the urls listed in the 400 errors lead to a page saying "Request must accept JSON in response".
Dr_Codswallop
<control-panel><error-message><csrf><https><ssl>
SSL now CP unknown errors
# SSL now CP unknown errors

(Asked by: username_0 on 2019-06-19)

I have a Craft 3 site that's been running on a production server. Recently we switched over to https but this has caused issues in the CP (multiple 'An unknown error occurred' red flags, can't view any of the individual entries or assets, CP utilities like clearing the cache tasks don't run).

Trying to debug it, this seems to largely resolve itself if I set `enableCSRF => false` in `config/general`. I can then use the CP to see & edit my entries & assets (although I still get an unknown error flag on the dashboard where the console shows a 400 error `get-feed-items` for the Craft News widget).

So seems to be related to the enableCSRF config setting. Whenever set it to `true` I get the `error 400` items in the console. I've cleared the browser cache multiple times but that doesn't fix it. I've cleared the Craft cache via the cp (but had to set CSRF to false again otherwise the script doesn't run and gives the 400 error again). Lastly I've manually nuked the `cpresources` folder in order for it to rebuild.

[![example of cp error](https://i.sstatic.net/Y2m7l.jpg)](https://i.sstatic.net/Y2m7l.jpg)

Web dev isn't my strong point so looking for suggestions so I can try and understand what's going on and what to try next.

**Tags:** control-panel, error-message, csrf, https, ssl
> **Comments:**
> **username_1**: Have you tried clearing your browser's cookies as well? CSRF tokens are stored in cookies and you might have an old non-SSL one set locally.  
> **username_0**: Hi Brad, I've cleared the cookies a few times and tried loading the cp through a new incognito window but still the same error. Also manually cleared the craft sessions db table but still same problem. Seems to be any cp pages requiring ajax calls, the urls listed in the 400 errors lead to a page saying "Request must accept JSON in response".  

---

## 1 answers

### Answer by username_0 on 2019-07-05. Score: 1

After much head scratching it wasn't an SSL issue. Litespeed had recently been installed on the shared server but was misconfigured.

> It appears the allowed header size default value was modified during
> the installation of LiteSpeed which caused the issue. We've now
> restored the default value and the functionality of the website
> appears to have come back.


---

