<p>So, removing the cache settings for CSS and JS in my nginx config fixed this.</p>

<pre><code># CSS and Javascript
location ~* \.(?:css|js)$ {
expires 1M;
access_log off;
}
</code></pre>

<p>Also, once I got into the admin area after adjusting this, resaving certain entries flushed the twig template cache.</p>

CC BY-SA 3.0
2016-07-07T16:41:44.157Z
2016-07-07T16:41:44.157Z
Adam Menczykowski
<p>I have had a Craft install running for some time now, and it has come to the point where I want to run it securely over HTTPS.</p>

<p>Using Laravel Forge, I have set up a Let's Encrypt certificate successfully, so on certain pages of the site it all works well. In my <code>config/general.php</code> file I altered the <code>siteUrl</code> and <code>environmentVariables</code> -> <code>baseUrl</code> to use https.</p>

<p>However when I try to log in to the admin on this server, in the JS Console, the GET requests for all the admin/resources CSS / JS files are returning 404. So the admin login screen shows without any styling, and crucially, logging in returns a bad CSRF token screen!</p>

<p>Any tips?</p>

<p>Thanks</p>

<p>Here's my nginx config:</p>

<pre><code># FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/before/*;

server {
    listen      80;
    server_name www.fira.co.uk;
    rewrite     ^   https://$server_name$request_uri? permanent;
}

server {
    listen 443 ssl;
    server_name www.fira.co.uk;
    root /home/forge/www.fira.co.uk/public;

    # FORGE SSL (DO NOT REMOVE!)
    ssl_certificate /etc/nginx/ssl/www.fira.co.uk/105882/server.crt;
    ssl_certificate_key /etc/nginx/ssl/www.fira.co.uk/105882/server.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparams.pem;

    index index.html index.htm index.php;

    charset utf-8;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/www.fira.co.uk/server/*;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/www.fira.co.uk-error.log error;

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    # Media: images, icons, video, audio, HTC
location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
  expires 1M;
  access_log off;
  add_header Cache-Control "public";
}

# CSS and Javascript
location ~* \.(?:css|js)$ {
  expires 1M;
  access_log off;
}
}

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/after/*;
</code></pre>

CC BY-SA 3.0
2016-07-07T15:43:59.180Z
Also, strangely all pages work perfectly, linking to https versions of image assets, however, the home page still provides mixed content (http) image links, thus throwing many errors in the console with regards to this.
Adam Menczykowski
CC BY-SA 3.0
2016-07-07T15:46:27.537Z
have you updated the htaccess too?
Steven Grant
CC BY-SA 3.0
2016-07-07T15:48:33.280Z
its nginx, and yes. See edited question. Thanks
Adam Menczykowski
CC BY-SA 3.0
2016-07-07T16:03:18.530Z
So all CP CSS/JS requests are 404'ing? Are they 404ing to the non https version of the site? Are you running any sort of caching on the site (Varnish/Fastly/opcache/Twig cache tags/etc)?
Brad Bell
CC BY-SA 3.0
2016-07-07T16:04:08.367Z
They are 404'ing to the https version
Adam Menczykowski
CC BY-SA 3.0
2016-07-07T16:04:56.833Z
Twig cache is used heavily thorughout templates
Adam Menczykowski
CC BY-SA 3.0
2016-07-07T16:19:32.057Z
All pages except home page are functioning well, without getting into the admin page the asset url's have respected the new config for https. The home page and the /admin/login screen have major issues still.
Adam Menczykowski
<server><ssl>
Craft site moved to HTTPS - now having issues
# Craft site moved to HTTPS - now having issues

(Asked by: username_0 on 2016-07-07)

I have had a Craft install running for some time now, and it has come to the point where I want to run it securely over HTTPS.
Using Laravel Forge, I have set up a Let's Encrypt certificate successfully, so on certain pages of the site it all works well. In my config/general.php file I altered the siteUrl and environmentVariables -> baseUrl to use https.
However when I try to log in to the admin on this server, in the JS Console, the GET requests for all the admin/resources CSS / JS files are returning 404. So the admin login screen shows without any styling, and crucially, logging in returns a bad CSRF token screen!
Any tips?
Thanks
Here's my nginx config:
# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/before/*;

server {
    listen      80;
    server_name www.fira.co.uk;
    rewrite     ^   https://$server_name$request_uri? permanent;
}

server {
    listen 443 ssl;
    server_name www.fira.co.uk;
    root /home/forge/www.fira.co.uk/public;

    # FORGE SSL (DO NOT REMOVE!)
    ssl_certificate /etc/nginx/ssl/www.fira.co.uk/105882/server.crt;
    ssl_certificate_key /etc/nginx/ssl/www.fira.co.uk/105882/server.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparams.pem;

    index index.html index.htm index.php;

    charset utf-8;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/www.fira.co.uk/server/*;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/www.fira.co.uk-error.log error;

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    # Media: images, icons, video, audio, HTC
location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
  expires 1M;
  access_log off;
  add_header Cache-Control "public";
}

# CSS and Javascript
location ~* \.(?:css|js)$ {
  expires 1M;
  access_log off;
}
}

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/after/*;

**Tags:** server, ssl
> **Comments:**
> **username_0**: Also, strangely all pages work perfectly, linking to https versions of image assets, however, the home page still provides mixed content (http) image links, thus throwing many errors in the console with regards to this.  
> **username_1**: have you updated the htaccess too?  
> **username_0**: its nginx, and yes. See edited question. Thanks  
> **username_2**: So all CP CSS/JS requests are 404'ing? Are they 404ing to the non https version of the site? Are you running any sort of caching on the site (Varnish/Fastly/opcache/Twig cache tags/etc)?  
> **username_0**: They are 404'ing to the https version  
> **username_0**: Twig cache is used heavily thorughout templates  
> **username_0**: All pages except home page are functioning well, without getting into the admin page the asset url's have respected the new config for https. The home page and the /admin/login screen have major issues still.  

---

## 1 answers

### Answer by username_0 on 2016-07-07. Score: 3

So, removing the cache settings for CSS and JS in my nginx config fixed this.
# CSS and Javascript
location ~* \.(?:css|js)$ {
expires 1M;
access_log off;
}

Also, once I got into the admin area after adjusting this, resaving certain entries flushed the twig template cache.


---

