Nginx loadbalancer https

Question

I'm running into problems when serving https via nginx as a load balancer. I have the following config:

server {
    listen       443 ssl;
    listen       [::]:443 ssl;
    server_name  sub.domain.com;

    root /usr/share/nginx/html;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;


    ssl_certificate         /etc/ssl/[cert].crt;
    ssl_certificate_key     /etc/ssl/private/wildcard.[cert].com.key;
    ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;

    ssl_ciphers '[...]'

    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/pki/tls/certs/dhparams.pem;


    location /application { proxy_pass http://server0; }

    location / {
            return 301 http://www.domain.com;
    }

}

And I'm serving a site running on a tomcat on "server0". Sometimes, not always, I get mixed content errors in the browser were requests have been sent over as http instead of https. I'm having problems reproducing the errors in in a concise manner since it sometimes works and sometimes not at all.

Any clues on how to proceed in diagnosing this?

Edit: No coded calls to http are made.

Answer 1

Assuming that all your calls are going to server0, so are on /application/<something> then one possible source of this issue is if the web pages served by server0 contain references to static resources and are fetched via http and not https.

Look with the developer tools of the browser. With Chrome, on the network tab you can see all the individual calls made by the browser to fetch additional resources as it parses the HTML from top to bottom, and you could perhaps spot what content came over unsecure http calls.

That is not the fault of the load balancer but rather of the implementation of the web app.