I have the following configuration on Debian based on 2 servers:

  1. On main server there are Apache2 and Magento 2 with Redis and Memcached.

  2. On 2nd server there is Varnish which listens on http://example.com:80

Everything works perfectly until I try to use https.

I installed nginx on the 2nd server and configured it to work as SSL termination according to this tutorial.


  • http://example.com works because it goes directly to Varnish
  • https://example.com ends with only text without css/js/images, because of the mixed content error below:

Error: "Mixed Content: The page at 'https:// example.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://example.com/pub/static/frontend/Mycompany/Mytheme/en_US/mage/calendar.css'. This request has been blocked; the content must be served over HTTPS."

Does it mean that it is not possible to use Magento 2 with Varnish over https?

Any advice?


5 Answers 5


Final I found the solution.

Replace the Base URL from http://example.com/ to //example.com/

CAUTION! The change is not allowed in magento2 admin.

I made it in MySQL in table cron_config_data and record with path='web/unsecure/base_url'. After cache:clean and varnish restart everything works smoothly in frontend.

Unfortunately problem remains in Backend. Magento2 redirects to this url: https://example.com/admin_mine/index/example.com/admin_mine/index/index/key/...

This last problem solved by simply change the Admin base url from Stores -> Configuration -> Advanced -> Admin -> Custom Admin URL = https://example.com/

  • this is the only solution I found that works! but it sounds as a hack since it is required to do from DB and not admin. Very strange that Magento makes a strong recommendation about varnish but does NOT explain how to configure properly magento when using TLS termination in front of varnish... Is this solution still working for you? or did you find something standard without this hack? thanks anyways!
    – Rod
    Commented Dec 20, 2020 at 8:15

If you're having issues with Magento not detecting the HTTPS redirect, you can add this to your the Magento .htaccess file located in your docroot:

## Nginx proxy HTTPS Fix for Magento
## Source: https://www.sonassi.com/blog/magento-kb/magento-https-redirect-loop-2
SetEnvIf X-Forwarded-Proto https HTTPS=on

See Also:


if you trying to run frontend as HTTPS, then your both unsecure and secure base urls must be https://example.com

enter image description here

  • This is a trick I've been using for years. Easy and works great. Who wants HTTP without HTTPS anyway? This is 2017.
    – Wouter
    Commented Feb 12, 2017 at 13:17

Yes, I tried. The results:

  1. Frontend Error: ERR_TOO_MANY_REDIRECTS.
  2. Admin: Not loading. Error: "The page isn't redirecting properly". I have changed the unsecure_base_url to http again from MySQL for admin to load again.

Of course after each change cache:clean.

Also in Magento2 -> Offloader header: HTTP_SSL_OFFLOADED


check web/secure/offloader_header. It was set to HTTP_SSL_OFFLOADED in my config.

initialRequestSecure() from vendor/magento/framework/HTTP/PhpEnvironment/Request.php seems to expect X_FORWARDED_PROTO instead. So I changed the value and now it works as expected:

bin/magento config:set web/secure/offloader_header X_FORWARDED_PROTO

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.