'. This request has been blocked; the content must be served over HTTPS
```
And 40 requests for fonts from `discourse-fonts` gem. This is a fresh installation where Postgres and Redis is run on a separate server inside local network and the connection is “socketed” but served to the outside over https of course. There are [similar](https://meta.discourse.org/t/blocked-loading-mixed-active-content-issue-related-to-fonts/195711) [threads](https://meta.discourse.org/t/mixed-content-the-page-at-url-was-loaded-over-https-error/216404) but no clear answer to me. Checking CSS points to `wizard.scss` (source-mapped). Any clues?
---
### Author:  [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [April 9, 2023, 11:04pm UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/2 "2023-04-09T23:04:56Z")
Did you enable the `force https` setting?
---
### Author:  [@silverdr](https://meta.discourse.org/u/silverdr)
#### Post date: [April 10, 2023, 8:41am UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/3 "2023-04-10T08:41:26Z")
Most probably no. Where do I set it? And why should it be needed in the first place instead of having the CSS request static assets over https or [relative references](https://www.rfc-editor.org/rfc/rfc3986#section-4.2)?
FWIW - on the outside facing webserver I do have the typical 301 set
#### Edit:
Found the setting based on [this post](https://meta.discourse.org/t/mixed-content-problem/121837/7), thank you @Arkshine
---
### Author:  [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [April 10, 2023, 11:14am UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/4 "2023-04-10T11:14:30Z")
I’m unsure why you have an http link somewhere; https should be enforced regardless.
You can find in the search bar:
---
### Author:  [@silverdr](https://meta.discourse.org/u/silverdr)
#### Post date: [April 10, 2023, 11:38am UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/5 "2023-04-10T11:38:07Z")
> [@Arkshine](#):
>
> I’m unsure why you have an http link somewhere
Well, me neither. I didn’t modify anything. Just the regular `launcher build app` These URLs seem to be in the processed CSS, which I obviously didn’t touch (nor the `scss`) in any way. I didn’t find anything https related in the app.yml either so.. don’t know. The `force_https` seem to work the problem around.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [April 10, 2023, 12:03pm UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/6 "2023-04-10T12:03:04Z")
`FORCE_HTTPS` tells Discourse to rewrite requests.
It’s necessary even if you’re doing ssl encapsulation outside the container to avoid the issue you’re describing.
---
### Author:  [@silverdr](https://meta.discourse.org/u/silverdr)
#### Post date: [April 11, 2023, 1:02pm UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/7 "2023-04-11T13:02:47Z")
It depends how we define “necessary”. Currently it might be necessary to work around the actual problem, which is that compiled CSS files reference static assets explicitly using `http` schema. But IMHO this should not be necessary in the long run
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [April 11, 2023, 10:59pm UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/8 "2023-04-11T22:59:40Z")
Necessary as in it’s the purpose of FORCE\_HTTPS - that’s how you tell Discourse that it’s being served securely and to rewrite links as such.
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [April 28, 2023, 9:33am UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/9 "2023-04-28T09:33:18Z")
So what factors/conditions would impact the assets (JS/CSS) URL protocol HTTP/HTTPS?
1. If you comment out below, and your site access from HTTP, then assets URL will be HTTP as well
```plaintext
#- "templates/web.ssl.template.yml"
#- "templates/web.letsencrypt.ssl.template.yml"
```
In this case, if you enable `force_https` you will end up with all assets URL error `R_SSL_PROTOCOL_ERROR` if you requested domain doesn’t install certificate. Then to avoid that you install certificate for that to resolve the SSL protocol issue
1. If you instead install Discourse with above template uncommented, the site’s assets URL should be HTTPS along with your site base URL protocol. And more, the `force https` is invisible in admin UI.
---
### Author:  [@silverdr](https://meta.discourse.org/u/silverdr)
#### Post date: [April 28, 2023, 11:04pm UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/10 "2023-04-28T23:04:01Z")
As mentioned in the original post, in my case certificate and everything is correct and valid but all connections to the outside are handled by a reverse-proxy (nginx, obviously ;-), while connection to discourse goes over unix socket. Meaning I have
`templates/web.socketed.template.yml`
rather than any of those you mention. Still - this should not need to cause static URLs have hardcoded explicit `http:` schema
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 28, 2023, 11:04pm UTC](https://meta.discourse.org/t/insecure-fonts-requests/261118/11 "2023-05-28T23:04:27Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.