I have an application that runs on nginx+unicorn. This is how my server block looks like
upstream rtdev{
# fail_timeout=0 means we always retry an upstream even if it failed
# to return a good HTTP response (in case the Unicorn master nukes a single worker for timing out).
server unix:/tmp/rtapp.sock fail_timeout=0;
}
server{
listen 443 ssl; # default;
server_name devapp.resolutiontweet.com;
root /home/xxxxxxx/xxxxxxxxx/public;
client_max_body_size 12M;
ssl on;
ssl_certificate xxxxxxxx/xxxxxxxxx.crt;
ssl_certificate_key xxxxxxxx/xxxxxxxxx.key;
ssl_ciphers "AES256+EECDH:AES256+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
ssl_stapling on; # Requires nginx >= 1.3.7
ssl_stapling_verify on; # Requires nginx => 1.3.7
location / {
access_log off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
proxy_headers_hash_max_size 8192;
proxy_headers_hash_bucket_size 256;
proxy_pass http://rtdev;
#proxy_redirect http://rtdev https://devapp.resolutiontweet.com;
}
}
I'm running into a weird issue where Safari doesn't show the "Lock" symbol for the secure site. All other browsers show it (tested on Chrome and Firefox). Attaching screenshots for reference.
Mozilla Firefox
Google Chrome
Safari
Modifying a few things in my server block fixes the issue, but the site doesn't load. For example changing,
proxy_pass http://rtdev; --> proxy_pass https://rtdev;
resolves the issue, but nginx throws 501 error.
I would appreciate if anyone can throw light on how to resolve/debug the issue. Thanks.
EDIT: The certificates are chained properly. I verified the settings with a couple of third party sites and everything seems fine.