0

I have an application that runs on nginx+unicorn. This is how my server block looks like

upstream rtdev{
# fail_timeout=0 means we always retry an upstream even if it failed
# to return a good HTTP response (in case the Unicorn master nukes a single worker for timing out).
server unix:/tmp/rtapp.sock fail_timeout=0;
}

server{

listen                443 ssl; # default;
server_name           devapp.resolutiontweet.com;
root                  /home/xxxxxxx/xxxxxxxxx/public;
client_max_body_size 12M;

ssl on;
ssl_certificate         xxxxxxxx/xxxxxxxxx.crt;
ssl_certificate_key     xxxxxxxx/xxxxxxxxx.key;

ssl_ciphers "AES256+EECDH:AES256+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

ssl_stapling on; # Requires nginx >= 1.3.7
ssl_stapling_verify on; # Requires nginx => 1.3.7

location / {
    access_log          off;

    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    proxy_redirect    off;
    proxy_headers_hash_max_size 8192;
    proxy_headers_hash_bucket_size 256;

    proxy_pass          http://rtdev;


    #proxy_redirect      http://rtdev https://devapp.resolutiontweet.com;
   }
}

I'm running into a weird issue where Safari doesn't show the "Lock" symbol for the secure site. All other browsers show it (tested on Chrome and Firefox). Attaching screenshots for reference.

Mozilla Firefox Google Chrome Safari

Mozilla Firefox Google Chrome Safari Modifying a few things in my server block fixes the issue, but the site doesn't load. For example changing, proxy_pass http://rtdev; --> proxy_pass https://rtdev; resolves the issue, but nginx throws 501 error.

I would appreciate if anyone can throw light on how to resolve/debug the issue. Thanks.

EDIT: The certificates are chained properly. I verified the settings with a couple of third party sites and everything seems fine.

2 Answers 2

1

I figured out the reason and it has got nothing to do with my server configuration.

Apparently, an unsafe script was injected dynamically by one of the libraries I was using. The script was using http not https.

Firefox and Chrome give an indication that the page contains unsafe scripts, Safari on the other hand, doesn't give user any feedback and shows the page as unsecure.

I don't know what to say, whether to applaud Apple for being overly cautious or to blame it for any lack of visual feedback.

References:

https://stackoverflow.com/questions/3292697/find-out-what-resources-are-not-going-over-https

https://www.whynopadlock.com/

0

Does

ssl_certificate xxxxxxxx/xxxxxxxxx.crt;

contain the server cert as well as the required intermediate charts (usually supplied by your CA with the cert)?

If the chain is incomplete that might cause issues with certain browsers (and especially smartphones).

1
  • Yeah, the chain is complete. I verified it on a couple of online sites too.
    – Naz Mir
    Oct 29, 2014 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .