0

I have an iFrame that's making a request to a HTTPS URL. I'm using NGINX to catch this request and proxy is to the correct URL, which is an HTTP backend Spotfire Server.

The HTTPS URL request: https://testURL.com:8443/spotfire/reportpath/01

This is my set up with NGINX:

server {
    listen 8443;
    server_name testURL.com;


    ssl on;
    ssl_certificate C:\OpenSSL\cert.pem;
    ssl_certificate_key C:\OpenSSL\cert.key;

    ssl_session_cache shared:SSL:1m;
    ssl_session_tickets off;
    ssl_session_timeout 5m;

    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location /spotfire/ {
        proxy_pass http://localSpotfireServerURL/spotfire/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

This successfully retrieves my report but the browser blocks the content because it's being served back on HTTP. I can allow the browser to server insecure content, but I don't want to do that. I've tried so many different settings and searches to get the content to come back securely but nothing has worked.

Here's what the browser is saying: Browser Error

Hopefully, someone out there has an answer for me

Colt Street
  • 1
  • 1

1 Answers1

0

I don't have enough reputations to put this up as a comment, but would it be possible to put up a screenshot of the browser console logs? At least putting up the error message in it's entirety would help. Whenever I've encountered an issue like this, it was because somewhere the application was actually trying to make an http request. Have you tried making the same request using curl or something?

johnzac92
  • 21
  • 1
  • I am making an HTTP request. The NGINX proxies the request to an HTTP Spotfire server to obtain a report. I need it to proxy it back to the client securely instead of trying to serve it back over HTTP. I added the message to the question. – Colt Street Sep 17 '18 at 20:06
  • I don't believe there is any way to make it work short of the application directly requesting for https. The browser will not even let the http request reach the server, it blocks them as soon as it sees the application trying to make an http request. – johnzac92 Sep 18 '18 at 02:46