Answers.Body: <p>So, removing the cache settings for CSS and JS in my nginx config fixed this.</p>
  
  <pre><code># CSS and Javascript
  location ~* \.(?:css|js)$ {
  expires 1M;
  access_log off;
  }
  </code></pre>
  
  <p>Also, once I got into the admin area after adjusting this, resaving certain entries flushed the twig template cache.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-07-07T16:41:44.157Z
Answers.LastActivityDate: 2016-07-07T16:41:44.157Z
Answers.UserDisplayName: Adam Menczykowski
Body: <p>I have had a Craft install running for some time now, and it has come to the point where I want to run it securely over HTTPS.</p>
  
  <p>Using Laravel Forge, I have set up a Let's Encrypt certificate successfully, so on certain pages of the site it all works well. In my <code>config/general.php</code> file I altered the <code>siteUrl</code> and <code>environmentVariables</code> -> <code>baseUrl</code> to use https.</p>
  
  <p>However when I try to log in to the admin on this server, in the JS Console, the GET requests for all the admin/resources CSS / JS files are returning 404. So the admin login screen shows without any styling, and crucially, logging in returns a bad CSRF token screen!</p>
  
  <p>Any tips?</p>
  
  <p>Thanks</p>
  
  <p>Here's my nginx config:</p>
  
  <pre><code># FORGE CONFIG (DOT NOT REMOVE!)
  include forge-conf/www.fira.co.uk/before/*;
  
  server {
      listen      80;
      server_name www.fira.co.uk;
      rewrite     ^   https://$server_name$request_uri? permanent;
  }
  
  server {
      listen 443 ssl;
      server_name www.fira.co.uk;
      root /home/forge/www.fira.co.uk/public;
  
      # FORGE SSL (DO NOT REMOVE!)
      ssl_certificate /etc/nginx/ssl/www.fira.co.uk/105882/server.crt;
      ssl_certificate_key /etc/nginx/ssl/www.fira.co.uk/105882/server.key;
  
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
      ssl_prefer_server_ciphers on;
      ssl_dhparam /etc/nginx/dhparams.pem;
  
      index index.html index.htm index.php;
  
      charset utf-8;
  
      # FORGE CONFIG (DOT NOT REMOVE!)
      include forge-conf/www.fira.co.uk/server/*;
  
      location / {
          try_files $uri $uri/ /index.php?$query_string;
      }
  
      location = /favicon.ico { access_log off; log_not_found off; }
      location = /robots.txt  { access_log off; log_not_found off; }
  
      access_log off;
      error_log  /var/log/nginx/www.fira.co.uk-error.log error;
  
      error_page 404 /index.php;
  
      location ~ \.php$ {
          fastcgi_split_path_info ^(.+\.php)(/.+)$;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_index index.php;
          include fastcgi_params;
      }
  
      location ~ /\.ht {
          deny all;
      }
  
      # Media: images, icons, video, audio, HTC
  location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
    expires 1M;
    access_log off;
    add_header Cache-Control "public";
  }
  
  # CSS and Javascript
  location ~* \.(?:css|js)$ {
    expires 1M;
    access_log off;
  }
  }
  
  # FORGE CONFIG (DOT NOT REMOVE!)
  include forge-conf/www.fira.co.uk/after/*;
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T15:43:59.180Z
Comments.Text: Also, strangely all pages work perfectly, linking to https versions of image assets, however, the home page still provides mixed content (http) image links, thus throwing many errors in the console with regards to this.
Comments.UserDisplayName: Adam Menczykowski
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T15:46:27.537Z
Comments.Text: have you updated the htaccess too?
Comments.UserDisplayName: Steven Grant
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T15:48:33.280Z
Comments.Text: its nginx, and yes. See edited question. Thanks
Comments.UserDisplayName: Adam Menczykowski
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T16:03:18.530Z
Comments.Text: So all CP CSS/JS requests are 404'ing? Are they 404ing to the non https version of the site? Are you running any sort of caching on the site (Varnish/Fastly/opcache/Twig cache tags/etc)?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T16:04:08.367Z
Comments.Text: They are 404'ing to the https version
Comments.UserDisplayName: Adam Menczykowski
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T16:04:56.833Z
Comments.Text: Twig cache is used heavily thorughout templates
Comments.UserDisplayName: Adam Menczykowski
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-07T16:19:32.057Z
Comments.Text: All pages except home page are functioning well, without getting into the admin page the asset url's have respected the new config for https. The home page and the /admin/login screen have major issues still.
Comments.UserDisplayName: Adam Menczykowski
Tags: <server><ssl>
Title: Craft site moved to HTTPS - now having issues
ThreadText: # Craft site moved to HTTPS - now having issues
  
  (Asked by: username_0 on 2016-07-07)
  
  I have had a Craft install running for some time now, and it has come to the point where I want to run it securely over HTTPS.
  
  Using Laravel Forge, I have set up a Let's Encrypt certificate successfully, so on certain pages of the site it all works well. In my `config/general.php` file I altered the `siteUrl` and `environmentVariables` -> `baseUrl` to use https.
  
  However when I try to log in to the admin on this server, in the JS Console, the GET requests for all the admin/resources CSS / JS files are returning 404. So the admin login screen shows without any styling, and crucially, logging in returns a bad CSRF token screen!
  
  Any tips?
  
  Thanks
  
  Here's my nginx config:
  
  ```
  # FORGE CONFIG (DOT NOT REMOVE!)
  include forge-conf/www.fira.co.uk/before/*;
  
  server {
      listen      80;
      server_name www.fira.co.uk;
      rewrite     ^   https://$server_name$request_uri? permanent;
  }
  
  server {
      listen 443 ssl;
      server_name www.fira.co.uk;
      root /home/forge/www.fira.co.uk/public;
  
      # FORGE SSL (DO NOT REMOVE!)
      ssl_certificate /etc/nginx/ssl/www.fira.co.uk/105882/server.crt;
      ssl_certificate_key /etc/nginx/ssl/www.fira.co.uk/105882/server.key;
  
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
      ssl_prefer_server_ciphers on;
      ssl_dhparam /etc/nginx/dhparams.pem;
  
      index index.html index.htm index.php;
  
      charset utf-8;
  
      # FORGE CONFIG (DOT NOT REMOVE!)
      include forge-conf/www.fira.co.uk/server/*;
  
      location / {
          try_files $uri $uri/ /index.php?$query_string;
      }
  
      location = /favicon.ico { access_log off; log_not_found off; }
      location = /robots.txt  { access_log off; log_not_found off; }
  
      access_log off;
      error_log  /var/log/nginx/www.fira.co.uk-error.log error;
  
      error_page 404 /index.php;
  
      location ~ \.php$ {
          fastcgi_split_path_info ^(.+\.php)(/.+)$;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_index index.php;
          include fastcgi_params;
      }
  
      location ~ /\.ht {
          deny all;
      }
  
      # Media: images, icons, video, audio, HTC
  location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
    expires 1M;
    access_log off;
    add_header Cache-Control "public";
  }
  
  # CSS and Javascript
  location ~* \.(?:css|js)$ {
    expires 1M;
    access_log off;
  }
  }
  
  # FORGE CONFIG (DOT NOT REMOVE!)
  include forge-conf/www.fira.co.uk/after/*;
  
  ```
  
  **Tags:** server, ssl
  
  > **Comments:**
  > **username_0**: Also, strangely all pages work perfectly, linking to https versions of image assets, however, the home page still provides mixed content (http) image links, thus throwing many errors in the console with regards to this.  
  > **username_1**: have you updated the htaccess too?  
  > **username_0**: its nginx, and yes. See edited question. Thanks  
  > **username_2**: So all CP CSS/JS requests are 404'ing? Are they 404ing to the non https version of the site? Are you running any sort of caching on the site (Varnish/Fastly/opcache/Twig cache tags/etc)?  
  > **username_0**: They are 404'ing to the https version  
  > **username_0**: Twig cache is used heavily thorughout templates  
  > **username_0**: All pages except home page are functioning well, without getting into the admin page the asset url's have respected the new config for https. The home page and the /admin/login screen have major issues still.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2016-07-07. Score: 3
  
  So, removing the cache settings for CSS and JS in my nginx config fixed this.
  
  ```
  # CSS and Javascript
  location ~* \.(?:css|js)$ {
  expires 1M;
  access_log off;
  }
  
  ```
  
  Also, once I got into the admin area after adjusting this, resaving certain entries flushed the twig template cache.
  
  
  ---
  
  