Answers.Body: <p>It's probable that your Site URL in your website's config is using <code>http</code> rather than <code>https</code>. Setting it to <code>https</code> should force the control panel assets to load appropriately.</p>
  
  <p>You can change this in Craft's <code>Settings &gt; System  &gt; General</code> screen.</p>
  
  <p>If you've overriden this in your website's config setting you'll instead need to update the <code>siteUrl</code> setting in that file. Documentation for this can be <a href="http://craftcms.com/docs/config-settings#siteUrl" rel="nofollow noreferrer">found here</a>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-11T15:19:28.963Z
Answers.LastActivityDate: 2017-03-11T15:19:28.963Z
Answers.UserDisplayName: Mutual
Answers.Body: <p>Craft's default setting is <code>'resourceBaseUrl' =&gt; '@web/cpresources'</code>. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your <code>siteUrl</code> / <code>ROOT_SITE_URL</code>.</p>
  
  <p><strong>To fix this, either overwrite <code>@web</code> or manually set <code>'resourceBaseUrl'</code>.</strong></p>
  
  <hr>
  
  <h2>Set resourceBaseUrl</h2>
  
  <p>Explictly set <code>'resourceBaseUrl' =&gt; getenv('ROOT_SITE_URL')</code> in config/general.php (assuming you ROOT_SITE_URL / siteUrl is set to something <a href="https://.." rel="nofollow noreferrer">https://..</a>.)</p>
  
  <hr>
  
  <h2>Overwrite @web</h2>
  
  <p>Overwrite <code>@web</code> in <code>config/general.php</code>:</p>
  
  <pre><code>// Aliases for use in CP
  'aliases' =&gt; [
      '@web' =&gt; getenv('ROOT_SITE_URL'),
  ]
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-03-26T18:45:49.103Z
Answers.LastActivityDate: 2020-03-26T20:15:39.533Z
Answers.LastEditDate: 2020-03-26T20:15:39.533Z
Answers.UserDisplayName: Max Strebel
Answers.Body: <p>The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.</p>
  
  <p>If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @MattStein for clueing me towards this approach.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-27T05:09:05.503Z
Answers.Text: Noting that this is also relevant for Craft 3
Answers.UserDisplayName: lealea
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-13T20:56:06.597Z
Answers.LastActivityDate: 2017-03-13T20:56:06.597Z
Answers.UserDisplayName: Rjoss
Body: <p>staging.website.com loads perfectly over https. However, https admin pages immediately break because the assets are trying to load over http. If I navigate to the https asset directly, it loads fine. It would seem that Craft is failing to recognize the https request and kick over to the https url.</p>
  
  <p>Server Setup:</p>
  
  <ul>
  <li>Cloudflare DNS / SSL</li>
  <li>Arcustech VPS with Ubuntu &amp; Apache</li>
  </ul>
  
  <p>How I am enforcing HTTPS currently:</p>
  
  <ul>
  <li>Cloudflare Page Rule (Always Use HTTPS)</li>
  <li>Craft config: general.php > environmentVariables (siteUrl, baseCpUrl, etc.)</li>
  </ul>
  
  <p>I do not have any https redirects going in my .htaccess - just the standard craft index.php logic. Adding https rules in the .htaccess will cause infinite loop redirects.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-10T19:55:46.833Z
Comments.Text: The type of Cloudflare SSL (full, flexible) matters, and a common problem is that Cloudflare offers https by querying your server at _http_ URLs and sprucing them up. Your server is likely responding admirably, but may need encouragement to serve https URLs in this situation: https://gist.github.com/joshuabaker/bb45340bc4eda4c7d932
Comments.UserDisplayName: Matt Stein
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-10T20:27:55.703Z
Comments.Text: Thanks for the quick reply. So if I went the "SSL full" route, do you think I would completely sidestep the issue I'm having here?
  
  I tried that Gist and its still reporting back http in the admin.
Comments.UserDisplayName: Rjoss
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-10T21:58:18.727Z
Comments.Text: Probably not, and I honestly forget but assume Cloudflare's going to send the same headers (hints about SSL) either way. It might help to post your Craft config and detail your Cloudflare setup. You might also consider the [Patrol plugin](https://selvinortiz.com/work/craft/patrol) if you haven't already and just want to get on with your https control paneling.
Comments.UserDisplayName: Matt Stein
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-10T22:49:05.423Z
Comments.Text: [general.php config](https://gist.github.com/Rjoss/1d21081ae15ee6cb19861e9b9bd90059), [Cloudflare DNS](https://cl.ly/253k270O1J3a), [Cloudflare Page Rules](https://cl.ly/1k00011j0H1k)
Comments.UserDisplayName: Rjoss
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-10T23:06:03.057Z
Comments.Text: I gave that Patrol plugin a shot - it definitely enforces https across the site. However, it seems to have no effect on the admin assets. In particular, Craft's admin css is trying to load a http font file: @font-face { font-family: 'Craft'; src: url("http://staging.website.com/admin/resources/fonts/Craft.eot?x=N99U2mbA3");
Comments.UserDisplayName: Rjoss
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-11T00:28:50.000Z
Comments.Text: And you've fully cleared Craft's and Cloudflare's caches as you've made configuration updates? Something seems fishy. Might also be better to move this to the Slack #help channel.
Comments.UserDisplayName: Matt Stein
Tags: <apache><https><cloudflare>
Title: Craft Admin assets do not load over https (Apache & Cloudflare)
ThreadText: # Craft Admin assets do not load over https (Apache & Cloudflare)
  
  (Asked by: username_0 on 2017-03-10)
  
  staging.website.com loads perfectly over https. However, https admin pages immediately break because the assets are trying to load over http. If I navigate to the https asset directly, it loads fine. It would seem that Craft is failing to recognize the https request and kick over to the https url.
  
  Server Setup:
  
  * Cloudflare DNS / SSL
  * Arcustech VPS with Ubuntu & Apache
  
  How I am enforcing HTTPS currently:
  
  * Cloudflare Page Rule (Always Use HTTPS)
  * Craft config: general.php > environmentVariables (siteUrl, baseCpUrl, etc.)
  
  I do not have any https redirects going in my .htaccess - just the standard craft index.php logic. Adding https rules in the .htaccess will cause infinite loop redirects.
  
  **Tags:** apache, https, cloudflare
  
  > **Comments:**
  > **username_1**: The type of Cloudflare SSL (full, flexible) matters, and a common problem is that Cloudflare offers https by querying your server at _http_ URLs and sprucing them up. Your server is likely responding admirably, but may need encouragement to serve https URLs in this situation: https://gist.github.com/joshuabaker/bb45340bc4eda4c7d932  
  > **username_0**: Thanks for the quick reply. So if I went the "SSL full" route, do you think I would completely sidestep the issue I'm having here?  I tried that Gist and its still reporting back http in the admin.  
  > **username_1**: Probably not, and I honestly forget but assume Cloudflare's going to send the same headers (hints about SSL) either way. It might help to post your Craft config and detail your Cloudflare setup. You might also consider the [Patrol plugin](https://selvinortiz.com/work/craft/patrol) if you haven't already and just want to get on with your https control paneling.  
  > **username_0**: [general.php config](https://gist.github.com/username_0/1d21081ae15ee6cb19861e9b9bd90059), [Cloudflare DNS](https://cl.ly/253k270O1J3a), [Cloudflare Page Rules](https://cl.ly/1k00011j0H1k)  
  > **username_0**: I gave that Patrol plugin a shot - it definitely enforces https across the site. However, it seems to have no effect on the admin assets. In particular, Craft's admin css is trying to load a http font file: @font-face { font-family: 'Craft'; src: url("http://staging.website.com/admin/resources/fonts/Craft.eot?x=N99U2mbA3");  
  > **username_1**: And you've fully cleared Craft's and Cloudflare's caches as you've made configuration updates? Something seems fishy. Might also be better to move this to the Slack #help channel.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2017-03-13. Score: 5 | Accepted answer
  
  The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.
  
  If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @username_1 for clueing me towards this approach.
  
  > **Comments:**
  > **username_4**: Noting that this is also relevant for Craft 3  
  
  ---
  
  ### Answer by username_2 on 2017-03-11. Score: 1
  
  It's probable that your Site URL in your website's config is using `http` rather than `https`. Setting it to `https` should force the control panel assets to load appropriately.
  
  You can change this in Craft's `Settings > System > General` screen.
  
  If you've overriden this in your website's config setting you'll instead need to update the `siteUrl` setting in that file. Documentation for this can be [found here](http://craftcms.com/docs/config-settings#siteUrl).
  
  
  ---
  
  ### Answer by username_3 on 2020-03-26. Score: 1
  
  Craft's default setting is `'resourceBaseUrl' => '@web/cpresources'`. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your `siteUrl` / `ROOT_SITE_URL`.
  
  **To fix this, either overwrite `@web` or manually set `'resourceBaseUrl'`.**
  
  ---
  
  ## Set resourceBaseUrl
  
  Explictly set `'resourceBaseUrl' => getenv('ROOT_SITE_URL')` in config/general.php (assuming you ROOT\_SITE\_URL / siteUrl is set to something <https://..>.)
  
  ---
  
  ## Overwrite @web
  
  Overwrite `@web` in `config/general.php`:
  
  ```
  // Aliases for use in CP
  'aliases' => [
      '@web' => getenv('ROOT_SITE_URL'),
  ]
  
  ```
  
  
  ---
  
  