Magento2 with Varnish 4 and Nginx as SSL termination ends in mixed content

Question

I have the following configuration on Debian based on 2 servers:

1. On main server there are Apache2 and Magento 2 with Redis and Memcached.

2. On 2nd server there is Varnish which listens on http://example.com:80

Everything works perfectly until I try to use https.

I installed nginx on the 2nd server and configured it to work as SSL termination according to this tutorial.

Now:

• http://example.com works because it goes directly to Varnish
• https://example.com ends with only text without css/js/images, because of the mixed content error below:

Error: "Mixed Content: The page at 'https:// example.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://example.com/pub/static/frontend/Mycompany/Mytheme/en_US/mage/calendar.css'. This request has been blocked; the content must be served over HTTPS."

Does it mean that it is not possible to use Magento 2 with Varnish over https?

Any advice?

Answer 1

Final I found the solution.

Replace the Base URL from http://example.com/ to //example.com/

CAUTION! The change is not allowed in magento2 admin.

I made it in MySQL in table cron_config_data and record with path='web/unsecure/base_url'. After cache:clean and varnish restart everything works smoothly in frontend.

Unfortunately problem remains in Backend. Magento2 redirects to this url: https://example.com/admin_mine/index/example.com/admin_mine/index/index/key/...

This last problem solved by simply change the Admin base url from Stores -> Configuration -> Advanced -> Admin -> Custom Admin URL = https://example.com/

Answer 2

If you're having issues with Magento not detecting the HTTPS redirect, you can add this to your the Magento .htaccess file located in your docroot:

############################################
## Nginx proxy HTTPS Fix for Magento
## Source: https://www.sonassi.com/blog/magento-kb/magento-https-redirect-loop-2
SetEnvIf X-Forwarded-Proto https HTTPS=on

See Also:

• https://gist.github.com/jaywilliams/6caae77d65ca69776a47
• https://www.sonassi.com/blog/magento-kb/magento-https-redirect-loop-2

Answer 3

if you trying to run frontend as HTTPS, then your both unsecure and secure base urls must be https://example.com

Answer 4

Yes, I tried. The results:

1. Frontend Error: ERR_TOO_MANY_REDIRECTS.
2. Admin: Not loading. Error: "The page isn't redirecting properly". I have changed the unsecure_base_url to http again from MySQL for admin to load again.

Of course after each change cache:clean.

Also in Magento2 -> Offloader header: HTTP_SSL_OFFLOADED

Answer 5

check web/secure/offloader_header. It was set to HTTP_SSL_OFFLOADED in my config.

initialRequestSecure() from vendor/magento/framework/HTTP/PhpEnvironment/Request.php seems to expect X_FORWARDED_PROTO instead. So I changed the value and now it works as expected:

bin/magento config:set web/secure/offloader_header X_FORWARDED_PROTO