3

staging.website.com loads perfectly over https. However, https admin pages immediately break because the assets are trying to load over http. If I navigate to the https asset directly, it loads fine. It would seem that Craft is failing to recognize the https request and kick over to the https url.

Server Setup:

  • Cloudflare DNS / SSL
  • Arcustech VPS with Ubuntu & Apache

How I am enforcing HTTPS currently:

  • Cloudflare Page Rule (Always Use HTTPS)
  • Craft config: general.php > environmentVariables (siteUrl, baseCpUrl, etc.)

I do not have any https redirects going in my .htaccess - just the standard craft index.php logic. Adding https rules in the .htaccess will cause infinite loop redirects.

  • The type of Cloudflare SSL (full, flexible) matters, and a common problem is that Cloudflare offers https by querying your server at http URLs and sprucing them up. Your server is likely responding admirably, but may need encouragement to serve https URLs in this situation: gist.github.com/joshuabaker/bb45340bc4eda4c7d932 – Matt Stein Mar 10 '17 at 19:55
  • Thanks for the quick reply. So if I went the "SSL full" route, do you think I would completely sidestep the issue I'm having here? I tried that Gist and its still reporting back http in the admin. – Rjoss Mar 10 '17 at 20:27
  • Probably not, and I honestly forget but assume Cloudflare's going to send the same headers (hints about SSL) either way. It might help to post your Craft config and detail your Cloudflare setup. You might also consider the Patrol plugin if you haven't already and just want to get on with your https control paneling. – Matt Stein Mar 10 '17 at 21:58
  • I gave that Patrol plugin a shot - it definitely enforces https across the site. However, it seems to have no effect on the admin assets. In particular, Craft's admin css is trying to load a http font file: @font-face { font-family: 'Craft'; src: url("staging.website.com/admin/resources/fonts/…); – Rjoss Mar 10 '17 at 23:06
4

The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.

If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @MattStein for clueing me towards this approach.

  • Noting that this is also relevant for Craft 3 – lealea Jun 27 '18 at 5:09
1

It's probable that your Site URL in your website's config is using http rather than https. Setting it to https should force the control panel assets to load appropriately.

You can change this in Craft's Settings > System > General screen.

If you've overriden this in your website's config setting you'll instead need to update the siteUrl setting in that file. Documentation for this can be found here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.