2

I have had a Craft install running for some time now, and it has come to the point where I want to run it securely over HTTPS.

Using Laravel Forge, I have set up a Let's Encrypt certificate successfully, so on certain pages of the site it all works well. In my config/general.php file I altered the siteUrl and environmentVariables -> baseUrl to use https.

However when I try to log in to the admin on this server, in the JS Console, the GET requests for all the admin/resources CSS / JS files are returning 404. So the admin login screen shows without any styling, and crucially, logging in returns a bad CSRF token screen!

Any tips?

Thanks

Here's my nginx config:

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/before/*;

server {
    listen      80;
    server_name www.fira.co.uk;
    rewrite     ^   https://$server_name$request_uri? permanent;
}

server {
    listen 443 ssl;
    server_name www.fira.co.uk;
    root /home/forge/www.fira.co.uk/public;

    # FORGE SSL (DO NOT REMOVE!)
    ssl_certificate /etc/nginx/ssl/www.fira.co.uk/105882/server.crt;
    ssl_certificate_key /etc/nginx/ssl/www.fira.co.uk/105882/server.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparams.pem;

    index index.html index.htm index.php;

    charset utf-8;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/www.fira.co.uk/server/*;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/www.fira.co.uk-error.log error;

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    # Media: images, icons, video, audio, HTC
location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
  expires 1M;
  access_log off;
  add_header Cache-Control "public";
}

# CSS and Javascript
location ~* \.(?:css|js)$ {
  expires 1M;
  access_log off;
}
}

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/www.fira.co.uk/after/*;
  • Also, strangely all pages work perfectly, linking to https versions of image assets, however, the home page still provides mixed content (http) image links, thus throwing many errors in the console with regards to this. – Adam Menczykowski Jul 7 '16 at 15:43
  • have you updated the htaccess too? – Steven Grant Jul 7 '16 at 15:46
  • its nginx, and yes. See edited question. Thanks – Adam Menczykowski Jul 7 '16 at 15:48
  • So all CP CSS/JS requests are 404'ing? Are they 404ing to the non https version of the site? Are you running any sort of caching on the site (Varnish/Fastly/opcache/Twig cache tags/etc)? – Brad Bell Jul 7 '16 at 16:03
  • They are 404'ing to the https version – Adam Menczykowski Jul 7 '16 at 16:04
3

So, removing the cache settings for CSS and JS in my nginx config fixed this.

# CSS and Javascript
location ~* \.(?:css|js)$ {
expires 1M;
access_log off;
}

Also, once I got into the admin area after adjusting this, resaving certain entries flushed the twig template cache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.