Answers.Body: <p>An addition on this, probably for later versions of Craft than @brandonkelly's answer.</p>
  
  <p>You also need to be careful where Asset definitions are made in the CP - specifically, under Settings>Assets>Volumes>yourAssetsName.</p>
  
  <ul>
  <li>the default or practice at some point was to have urls of the form:</li>
  </ul>
  
  <pre><code>    @web/your/resource/path
  </code></pre>
  
  <ul>
  <li>however, as of Craft 3.1, a red-lettered advisory will appear, not to use @web alias here. Indeed, with the proper form, all will work as expected, and https will be used when appropriate:</li>
  </ul>
  
  <pre><code>    /your/resource/path
  </code></pre>
  
  <p>This works however you are accessing the url, even in CraftQL or element-api, because the path will always be root url-relative.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-01-29T19:34:30.053Z
Answers.LastActivityDate: 2019-01-30T23:04:15.780Z
Answers.LastEditDate: 2019-01-30T23:04:15.780Z
Answers.UserDisplayName: narration_sd
Answers.Body: <p>Yii will check for the following server environment variables <a href="https://github.com/yiisoft/yii/blob/1.1.16/framework/web/CHttpRequest.php#L573" rel="nofollow">when determining if it’s an SSL request</a>:</p>
  
  <ul>
  <li><strong>HTTPS</strong> – should be set to “on”, “ON”, or “1”; or</li>
  <li><strong>HTTP_X_FORWARDED_PROTO</strong> – should be set to “https” or “HTTPS”</li>
  </ul>
  
  <p>Apparently this is a common issue when running PHP on Nginx, since that HTTPS env variable is only an Apache convention.</p>
  
  <p><a href="http://blog.chrismeller.com/getting-php-https-detection-working-in-nginx" rel="nofollow">Here’s an article that demonstrates how to fix it</a>. According to that, you just need to add the following to your server config.</p>
  
  <pre><code>fastcgi_param HTTPS on;
  </code></pre>
  
  <p>You can probably add it right before/after your other <code>fastcgi_param</code> line.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-08T00:27:10.037Z
Answers.Text: Thanks for the answer. Should the asset settings matter for the admin panel's JS/CSS files? So on my admin login page I'm getting an error loading `http://mysite.com/admin/resources/js/craft.js` even though my `siteUrl` is set to `//mysite.com`. Is this URL being built some other way?
Answers.UserDisplayName: Jon
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-08T13:39:35.327Z
Answers.Text: @Jon Sorry, missed that the question was for the Control Panel. Just updated my answer.
Answers.UserDisplayName: Brandon Kelly
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-09T00:03:31.070Z
Answers.Text: Side note: nginx's ``$https`` variable should be [defined](http://serverfault.com/a/484460) as of 1.1.11 (which is pretty jurassic) so you could use ``fastcgi_param HTTPS $https`` as well.
Answers.UserDisplayName: RitterKnight
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-01-29T19:35:10.277Z
Answers.Text: see my reply below, though, for additional and/or more contempory information...
Answers.UserDisplayName: narration_sd
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-07T23:05:57.050Z
Answers.LastActivityDate: 2015-10-08T13:38:58.213Z
Answers.LastEditDate: 2015-10-08T13:38:58.213Z
Answers.UserDisplayName: Brandon Kelly
Body: <p>I'm currently redirecting all requests to https. I've updated the <code>siteUrl</code> variable and all of my entry links have been correctly updated but the image links are still http.</p>
  
  <p>When I go to the admin panel all of the CSS/JS files wont load because the site is trying to load them over HTTP instead of HTTPS.</p>
  
  <p><img src="https://photos-6.dropbox.com/t/2/AABE7B8Z05VsQeEq-Ln6qRJZZ0rFIcb4JaigHdsokjB7AQ/12/374678821/png/32x32/1/_/1/2/Screenshot%202015-10-07%2013.17.58.png/EKWZvPsCGDMgBygH/Ck_T7LRtOzM9XAWqpavcVG-U_KOehUMKGbL0-31Bro4?size=2048x1536&amp;size_mode=2" alt=""></p>
  
  <pre><code>server {
  
    listen   443;
  
    root /var/www/&lt;url&gt;/htdocs;
    index index.php index.html index.htm;
  
    ssl on;
    ssl_certificate /etc/ssl/cert.crt;
    ssl_certificate_key /etc/ssl/rsa.key;
    server_name &lt;url&gt;;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
    client_max_body_size 10M;
  
  
    location ~ \.php$ {
      try_files $uri =404;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/opt/remi/php55/root/var/run/php-fpm/php-fpm.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      include fastcgi_params;
    }
  
    location / {
    try_files $uri $uri/ @rewrites;
    }
  
    location @rewrites {
      rewrite ^(.*) /index.php?p=$1 last;
    }
  
    # Errors
  
    error_page 404 /index.php;
    error_page 500 502 503 504 /50x.html;
  
    location = /50x.html {
      root /var/www/&lt;url&gt;/htdocs;
    }
  
    # Enable gzip compression
    gzip on;
    gzip_comp_level 2;
    gzip_http_version 1.0;
    gzip_proxied any;
    gzip_min_length 1100;
    gzip_buffers 16 8k;
    gzip_types text/plain text/html text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
  
    # Disable for IE &lt; 6 because there are some known problems
    gzip_disable "MSIE [1-6].(?!.*SV1)";
  
    # Add a vary header for downstream proxies to avoid sending cached gzipped files to IE6
    gzip_vary on;
  
  }
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-10-07T22:00:13.080Z
Comments.Text: You doing anything in your `.htaccess` file that would need updating?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-10-07T22:04:03.863Z
Comments.Text: Added my whole vhost entry for port 443
Comments.UserDisplayName: Jon
Tags: <assets><admin><nginx><ssl>
Title: Asset URLs not HTTPS
ThreadText: # Asset URLs not HTTPS
  
  (Asked by: username_0 on 2015-10-07)
  
  I'm currently redirecting all requests to https. I've updated the `siteUrl` variable and all of my entry links have been correctly updated but the image links are still http.
  
  When I go to the admin panel all of the CSS/JS files wont load because the site is trying to load them over HTTP instead of HTTPS.
  
  ![](https://photos-6.dropbox.com/t/2/AABE7B8Z05VsQeEq-Ln6qRJZZ0rFIcb4JaigHdsokjB7AQ/12/374678821/png/32x32/1/_/1/2/Screenshot%202015-10-07%2013.17.58.png/EKWZvPsCGDMgBygH/Ck_T7LRtOzM9XAWqpavcVG-U_KOehUMKGbL0-31Bro4?size=2048x1536&size_mode=2)
  
  ```
  server {
  
    listen   443;
  
    root /var/www/<url>/htdocs;
    index index.php index.html index.htm;
  
    ssl on;
    ssl_certificate /etc/ssl/cert.crt;
    ssl_certificate_key /etc/ssl/rsa.key;
    server_name <url>;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
    client_max_body_size 10M;
  
    location ~ \.php$ {
      try_files $uri =404;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/opt/remi/php55/root/var/run/php-fpm/php-fpm.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      include fastcgi_params;
    }
  
    location / {
    try_files $uri $uri/ @rewrites;
    }
  
    location @rewrites {
      rewrite ^(.*) /index.php?p=$1 last;
    }
  
    # Errors
  
    error_page 404 /index.php;
    error_page 500 502 503 504 /50x.html;
  
    location = /50x.html {
      root /var/www/<url>/htdocs;
    }
  
    # Enable gzip compression
    gzip on;
    gzip_comp_level 2;
    gzip_http_version 1.0;
    gzip_proxied any;
    gzip_min_length 1100;
    gzip_buffers 16 8k;
    gzip_types text/plain text/html text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
  
    # Disable for IE < 6 because there are some known problems
    gzip_disable "MSIE [1-6].(?!.*SV1)";
  
    # Add a vary header for downstream proxies to avoid sending cached gzipped files to IE6
    gzip_vary on;
  
  }
  
  ```
  
  **Tags:** assets, admin, nginx, ssl
  
  > **Comments:**
  > **username_1**: You doing anything in your `.htaccess` file that would need updating?  
  > **username_0**: Added my whole vhost entry for port 443  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2015-10-07. Score: 7 | Accepted answer
  
  Yii will check for the following server environment variables [when determining if it’s an SSL request](https://github.com/yiisoft/yii/blob/1.1.16/framework/web/CHttpRequest.php#L573):
  
  * **HTTPS** – should be set to “on”, “ON”, or “1”; or
  * **HTTP\_X\_FORWARDED\_PROTO** – should be set to “https” or “HTTPS”
  
  Apparently this is a common issue when running PHP on Nginx, since that HTTPS env variable is only an Apache convention.
  
  [Here’s an article that demonstrates how to fix it](http://blog.chrismeller.com/getting-php-https-detection-working-in-nginx). According to that, you just need to add the following to your server config.
  
  ```
  fastcgi_param HTTPS on;
  
  ```
  
  You can probably add it right before/after your other `fastcgi_param` line.
  
  > **Comments:**
  > **username_0**: Thanks for the answer. Should the asset settings matter for the admin panel's JS/CSS files? So on my admin login page I'm getting an error loading `http://mysite.com/admin/resources/js/craft.js` even though my `siteUrl` is set to `//mysite.com`. Is this URL being built some other way?  
  > **username_3**: @username_0 Sorry, missed that the question was for the Control Panel. Just updated my answer.  
  > **username_4**: Side note: nginx's ``$https`` variable should be [defined](http://serverfault.com/a/484460) as of 1.1.11 (which is pretty jurassic) so you could use ``fastcgi_param HTTPS $https`` as well.  
  > **username_2**: see my reply below, though, for additional and/or more contempory information...  
  
  ---
  
  ### Answer by username_2 on 2019-01-29. Score: 2
  
  An addition on this, probably for later versions of Craft than @username_3's answer.
  
  You also need to be careful where Asset definitions are made in the CP - specifically, under Settings>Assets>Volumes>yourAssetsName.
  
  * the default or practice at some point was to have urls of the form:
  
  ```
      @web/your/resource/path
  
  ```
  
  * however, as of Craft 3.1, a red-lettered advisory will appear, not to use @web alias here. Indeed, with the proper form, all will work as expected, and https will be used when appropriate:
  
  ```
      /your/resource/path
  
  ```
  
  This works however you are accessing the url, even in CraftQL or element-api, because the path will always be root url-relative.
  
  
  ---
  
  