When I open the site using https://mydomain.com all layout (front/backend) is "broken" and appears inconsistent:

  • The headers contains all js/css but they are loaded with http:// protocol and the css rules are not applied

My problem looks exactly like this: https://demo.magentocommerce.com/

I have tested on my local installation ( same DB/CODE ) and it is working fine.

EDIT 2 After some investigation we found out that our FastCGI/Sbox is not setting HTTPS server variable when needed and that cause the wrong behavior on Magento

  • check your secure url settings. – user487772 Feb 21 '13 at 13:50
  • those are ok https://mydomain.com – Fra Feb 21 '13 at 13:52
  • 2
    Maybe you have the setting on a level lower (website, store) where the setting is different? Or there is caching going on? – mpaepper Feb 21 '13 at 14:01
  • Really this is not the issue, I'm quite sure it is server config related problem – Fra Feb 21 '13 at 14:06
  • @Francesco make sure that you have a trailing slash in those fields – philwinkle Feb 21 '13 at 14:25

Your browser is probably blocking un-secure content

Some versions of recent browsers (FireFox/Chrome) will reject HTTP content when the page is served over HTTPS. This is to prevent insecure content being served alongside secure content.

So if you visit the homepage in Magento and specify https:// in the URL, all the linked resources within the page source will still be http:// - and the browser may reject loading that content to preserve security.

But if you've loaded the page once before, there's a good chance that some CSS/JS/Images may well already be in the browser cache, mitigating the requirement to fetch the resource remotely.

This can give the impression that it works on some machines and not on others. Where in reality - its not really working for anyone, its just that some users benefit from their historical browser cache.

Self-signed certificates can also produce this exact behaviour.

Magento won't use HTTPS on the Homepage by default

Magento doesn't want/need to serve content over https:// unless either

  1. The page warrants HTTPS (customer account, checkout etc.)
  2. You changed the unsecure base url to be HTTPS regardless

Under normal situations, there simply isn't a requirement for the homepage to be served over HTTPS - and if your unsecure base url is just http:// - then Magento will still continue to load un-secure resources.

So if you want HTTPS on your homepage, either change core code to dictate whether the area needs to be secure or not - or make the entire site HTTPS regardless.

Its normal, don't worry

Basically, what you are seeing is normal behaviour - on the front-end at least. Just because you want HTTPS on the homepage, doesn't mean Magento will serve everything to you with HTTPS.

Its more concerning what is happening with your back-end, but again, if you haven't actually enabled "Use Secure URLs in Admin" and defined a https:// URL for the "Base Secure URL" - then again, what you see is normal.

If you want HTTPS, ensure you enable in the front-end/back-end as appropriate and set the "Base Secure URL" to suit.

  • I think the issue is related to Fastcgi/sbox: I have checked and it doens't set the variable Server variable HTTPS. – Fra Feb 22 '13 at 16:29
  • What I'm experiencing it is not the default magento behavior: as I wrote in the question it works well on my local installation – Fra Feb 22 '13 at 16:30
  • Unless you have set ALL your URLs to be HTTPS - Magento will NOT serve HTTPS content on the homepage. And your browser will potentially block that content. Take our own website as an example, sonassihosting.com - forcing HTTPS breaks the CSS and JS rendering in FireFox. – Ben Lessani - Sonassi Feb 22 '13 at 17:52
  • this just a test to debug the issue: that is why I'm opening the url direclty on https://. On local it work on live not, the reason is the above comment – Fra Feb 22 '13 at 17:58
  • But you cannot test it with the homepage. Test a resource that actually should be HTTPS, checkout/customer login etc. Not the homepage, *unlesss you've changed the unsecure base URL to be https:// – Ben Lessani - Sonassi Feb 26 '13 at 17:11

The issue was generated by the server environment, it did not set [HTTPS] variable in the right way.

Adding this line in index.php restored the expected behavior

if (isset($_SERVER['SERVER_PORT']) && (443 == $_SERVER['SERVER_PORT'])) $_SERVER['HTTPS'] = 'on';
  • 3
    See this article - you could do that more elegantly in your .htaccess. By using SetEnvIf SERVER_PORT 443 HTTPS=on – Ben Lessani - Sonassi Feb 28 '13 at 15:36
  • you are right, however 'SetEnv' and 'SetEnvIF' doesn't work on some CGI Env. – Fra Mar 1 '13 at 9:25
  • 1
    Then set the fastcgi_param accordingly then. Eg. for Nginx fastcgi_param HTTPS $https if_not_empty; – Ben Lessani - Sonassi Mar 1 '13 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.