2

I have had a Craft install running for some time now, and it has come to the point where I want to run it securely over HTTPS.

Using Laravel Forge, I have set up a Let's Encrypt certificate successfully, so on certain pages of the site it all works well. In my config/general.php file I altered the siteUrl and environmentVariables -> baseUrl to use https.

However when I try to log in to the admin on this server, in the JS Console, the GET requests for all the admin/resources CSS / JS files are returning 404. So the admin login screen shows without any styling, and crucially, logging in returns a bad CSRF token screen!

Any tips?

Thanks

Here's my nginx config:

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/before/*;

server {
    listen      80;
    server_name www.fira.co.uk;
    rewrite     ^   https://$server_name$request_uri? permanent;
}

server {
    listen 443 ssl;
    server_name www.fira.co.uk;
    root /home/forge/www.fira.co.uk/public;

    # FORGE SSL (DO NOT REMOVE!)
    ssl_certificate /etc/nginx/ssl/www.fira.co.uk/105882/server.crt;
    ssl_certificate_key /etc/nginx/ssl/www.fira.co.uk/105882/server.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparams.pem;

    index index.html index.htm index.php;

    charset utf-8;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/www.fira.co.uk/server/*;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/www.fira.co.uk-error.log error;

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    # Media: images, icons, video, audio, HTC
location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
  expires 1M;
  access_log off;
  add_header Cache-Control "public";
}

# CSS and Javascript
location ~* \.(?:css|js)$ {
  expires 1M;
  access_log off;
}
}

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/after/*;
Improve this question
7
  • Also, strangely all pages work perfectly, linking to https versions of image assets, however, the home page still provides mixed content (http) image links, thus throwing many errors in the console with regards to this.
    – Adam Menczykowski
    Commented Jul 7, 2016 at 15:43
  • have you updated the htaccess too?
    – Steven Grant
    Commented Jul 7, 2016 at 15:46
  • its nginx, and yes. See edited question. Thanks
    – Adam Menczykowski
    Commented Jul 7, 2016 at 15:48
  • So all CP CSS/JS requests are 404'ing? Are they 404ing to the non https version of the site? Are you running any sort of caching on the site (Varnish/Fastly/opcache/Twig cache tags/etc)?
    – Brad Bell ♦
    Commented Jul 7, 2016 at 16:03
  • They are 404'ing to the https version
    – Adam Menczykowski
    Commented Jul 7, 2016 at 16:04

1 Answer 1

Reset to default
3

So, removing the cache settings for CSS and JS in my nginx config fixed this.

# CSS and Javascript
location ~* \.(?:css|js)$ {
expires 1M;
access_log off;
}

Also, once I got into the admin area after adjusting this, resaving certain entries flushed the twig template cache.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.