<p>An addition on this, probably for later versions of Craft than @brandonkelly's answer.</p>

<p>You also need to be careful where Asset definitions are made in the CP - specifically, under Settings>Assets>Volumes>yourAssetsName.</p>

<ul>
<li>the default or practice at some point was to have urls of the form:</li>
</ul>

<pre><code>    @web/your/resource/path
</code></pre>

<ul>
<li>however, as of Craft 3.1, a red-lettered advisory will appear, not to use @web alias here. Indeed, with the proper form, all will work as expected, and https will be used when appropriate:</li>
</ul>

<pre><code>    /your/resource/path
</code></pre>

<p>This works however you are accessing the url, even in CraftQL or element-api, because the path will always be root url-relative.</p>

CC BY-SA 4.0
2019-01-29T19:34:30.053Z
2019-01-30T23:04:15.780Z
2019-01-30T23:04:15.780Z
narration_sd
<p>Yii will check for the following server environment variables <a href="https://github.com/yiisoft/yii/blob/1.1.16/framework/web/CHttpRequest.php#L573" rel="nofollow">when determining if it’s an SSL request</a>:</p>

<ul>
<li><strong>HTTPS</strong> – should be set to “on”, “ON”, or “1”; or</li>
<li><strong>HTTP_X_FORWARDED_PROTO</strong> – should be set to “https” or “HTTPS”</li>
</ul>

<p>Apparently this is a common issue when running PHP on Nginx, since that HTTPS env variable is only an Apache convention.</p>

<p><a href="http://blog.chrismeller.com/getting-php-https-detection-working-in-nginx" rel="nofollow">Here’s an article that demonstrates how to fix it</a>. According to that, you just need to add the following to your server config.</p>

<pre><code>fastcgi_param HTTPS on;
</code></pre>

<p>You can probably add it right before/after your other <code>fastcgi_param</code> line.</p>

CC BY-SA 3.0
2015-10-08T00:27:10.037Z
Thanks for the answer. Should the asset settings matter for the admin panel's JS/CSS files? So on my admin login page I'm getting an error loading `http://mysite.com/admin/resources/js/craft.js` even though my `siteUrl` is set to `//mysite.com`. Is this URL being built some other way?
Jon
CC BY-SA 3.0
2015-10-08T13:39:35.327Z
@Jon Sorry, missed that the question was for the Control Panel. Just updated my answer.
Brandon Kelly
CC BY-SA 3.0
2015-10-09T00:03:31.070Z
Side note: nginx's ``$https`` variable should be [defined](http://serverfault.com/a/484460) as of 1.1.11 (which is pretty jurassic) so you could use ``fastcgi_param HTTPS $https`` as well.
RitterKnight
CC BY-SA 4.0
2019-01-29T19:35:10.277Z
see my reply below, though, for additional and/or more contempory information...
narration_sd
CC BY-SA 3.0
2015-10-07T23:05:57.050Z
2015-10-08T13:38:58.213Z
2015-10-08T13:38:58.213Z
Brandon Kelly
<p>I'm currently redirecting all requests to https. I've updated the <code>siteUrl</code> variable and all of my entry links have been correctly updated but the image links are still http.</p>

<p>When I go to the admin panel all of the CSS/JS files wont load because the site is trying to load them over HTTP instead of HTTPS.</p>

<p><img src="https://photos-6.dropbox.com/t/2/AABE7B8Z05VsQeEq-Ln6qRJZZ0rFIcb4JaigHdsokjB7AQ/12/374678821/png/32x32/1/_/1/2/Screenshot%202015-10-07%2013.17.58.png/EKWZvPsCGDMgBygH/Ck_T7LRtOzM9XAWqpavcVG-U_KOehUMKGbL0-31Bro4?size=2048x1536&amp;size_mode=2" alt=""></p>

<pre><code>server {

  listen   443;

  root /var/www/&lt;url&gt;/htdocs;
  index index.php index.html index.htm;

  ssl on;
  ssl_certificate /etc/ssl/cert.crt;
  ssl_certificate_key /etc/ssl/rsa.key;
  server_name &lt;url&gt;;
  proxy_set_header X-Forwarded-For $remote_addr;
  proxy_set_header X-Forwarded-Proto https;
  client_max_body_size 10M;


  location ~ \.php$ {
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/opt/remi/php55/root/var/run/php-fpm/php-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location / {
  try_files $uri $uri/ @rewrites;
  }

  location @rewrites {
    rewrite ^(.*) /index.php?p=$1 last;
  }

  # Errors

  error_page 404 /index.php;
  error_page 500 502 503 504 /50x.html;

  location = /50x.html {
    root /var/www/&lt;url&gt;/htdocs;
  }

  # Enable gzip compression
  gzip on;
  gzip_comp_level 2;
  gzip_http_version 1.0;
  gzip_proxied any;
  gzip_min_length 1100;
  gzip_buffers 16 8k;
  gzip_types text/plain text/html text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;

  # Disable for IE &lt; 6 because there are some known problems
  gzip_disable "MSIE [1-6].(?!.*SV1)";

  # Add a vary header for downstream proxies to avoid sending cached gzipped files to IE6
  gzip_vary on;

}
</code></pre>

CC BY-SA 3.0
2015-10-07T22:00:13.080Z
You doing anything in your `.htaccess` file that would need updating?
Brad Bell
CC BY-SA 3.0
2015-10-07T22:04:03.863Z
Added my whole vhost entry for port 443
Jon
<assets><admin><nginx><ssl>
Asset URLs not HTTPS
# Asset URLs not HTTPS

(Asked by: username_0 on 2015-10-07)

I'm currently redirecting all requests to https. I've updated the siteUrl variable and all of my entry links have been correctly updated but the image links are still http.
When I go to the admin panel all of the CSS/JS files wont load because the site is trying to load them over HTTP instead of HTTPS.

server {

  listen   443;

  root /var/www//htdocs;
  index index.php index.html index.htm;

  ssl on;
  ssl_certificate /etc/ssl/cert.crt;
  ssl_certificate_key /etc/ssl/rsa.key;
  server_name ;
  proxy_set_header X-Forwarded-For $remote_addr;
  proxy_set_header X-Forwarded-Proto https;
  client_max_body_size 10M;


  location ~ \.php$ {
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/opt/remi/php55/root/var/run/php-fpm/php-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location / {
  try_files $uri $uri/ @rewrites;
  }

  location @rewrites {
    rewrite ^(.*) /index.php?p=$1 last;
  }

  # Errors

  error_page 404 /index.php;
  error_page 500 502 503 504 /50x.html;

  location = /50x.html {
    root /var/www//htdocs;
  }

  # Enable gzip compression
  gzip on;
  gzip_comp_level 2;
  gzip_http_version 1.0;
  gzip_proxied any;
  gzip_min_length 1100;
  gzip_buffers 16 8k;
  gzip_types text/plain text/html text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;

  # Disable for IE < 6 because there are some known problems
  gzip_disable "MSIE [1-6].(?!.*SV1)";

  # Add a vary header for downstream proxies to avoid sending cached gzipped files to IE6
  gzip_vary on;

}

**Tags:** assets, admin, nginx, ssl

> **Comments:**
> **username_1**: You doing anything in your `.htaccess` file that would need updating?  
> **username_0**: Added my whole vhost entry for port 443  

---

## 2 answers

### Answer by username_3 on 2015-10-07. Score: 7 | Accepted answer

Yii will check for the following server environment variables when determining if it’s an SSL request:

HTTPS – should be set to “on”, “ON”, or “1”; or
HTTP_X_FORWARDED_PROTO – should be set to “https” or “HTTPS”

Apparently this is a common issue when running PHP on Nginx, since that HTTPS env variable is only an Apache convention.
Here’s an article that demonstrates how to fix it. According to that, you just need to add the following to your server config.
fastcgi_param HTTPS on;

You can probably add it right before/after your other fastcgi_param line.

> **Comments:**
> **username_0**: Thanks for the answer. Should the asset settings matter for the admin panel's JS/CSS files? So on my admin login page I'm getting an error loading `http://mysite.com/admin/resources/js/craft.js` even though my `siteUrl` is set to `//mysite.com`. Is this URL being built some other way?  
> **username_3**: @username_0 Sorry, missed that the question was for the Control Panel. Just updated my answer.  
> **username_4**: Side note: nginx's ``$https`` variable should be [defined](http://serverfault.com/a/484460) as of 1.1.11 (which is pretty jurassic) so you could use ``fastcgi_param HTTPS $https`` as well.  
> **username_2**: see my reply below, though, for additional and/or more contempory information...  

---

### Answer by username_2 on 2019-01-29. Score: 2

An addition on this, probably for later versions of Craft than @brandonkelly's answer.
You also need to be careful where Asset definitions are made in the CP - specifically, under Settings>Assets>Volumes>yourAssetsName.

the default or practice at some point was to have urls of the form:

    @web/your/resource/path


however, as of Craft 3.1, a red-lettered advisory will appear, not to use @web alias here. Indeed, with the proper form, all will work as expected, and https will be used when appropriate:

    /your/resource/path

This works however you are accessing the url, even in CraftQL or element-api, because the path will always be root url-relative.


---

