Unable to get secure connection when getting it co

Question

I am struggling with an issue where I am unable to get my Flask app with a secure connection. Whenever I open my site then I get a yellow exclamation mark which says my connection is not secure. I have seen every tutorial but not seem to be getting as why this is happening. Could anyone please help me. Below is the configuration.

UWSGI command

screen uwsgi --socket 0.0.0.0:5000 --ini /root/trujet/truejet.ini --protocol=http -w wsgi:app &

Nginx configuration

server {
        listen 80;
        listen [::]:80;
        server_name truejet.in www.truejet.in;
        ssl_certificate /etc/letsencrypt/live/www.truejet.in/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.truejet.in/privkey.pem;
        ssl_dhparam /etc/letsencrypt/live/www.truejet.in/dhparam.pem;
        rewrite     ^   https://$server_name$request_uri? permanent;
        location / {
                proxy_pass http://0.0.0.0:5000;
        }

}


server {
        listen 443 default_server ssl;
        server_name www.truejet.in truejet.in;
        ssl on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_certificate /etc/letsencrypt/live/www.truejet.in/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.truejet.in/privkey.pem;
        ssl_dhparam /etc/letsencrypt/live/www.truejet.in/dhparam.pem;
        client_max_body_size 5M;
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        location / {
        proxy_buffering off;
        proxy_pass http://0.0.0.0:5000;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Referer "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-SSL on;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
    }

        resolver 8.8.8.8 8.8.4.4 valid=300s;

}

And yes, my certificates are valid

Answer 1

I think the issue you are facing might be related to Firefox...

Can you confirm if you have the Root CA of Lets Encrypt (https://letsencrypt.org/certificates/)

If "Let's Encrypt Authority X3" is missing then download the root from above url and add it to Mozilla Firefox.

My other suggestion would be to refer below for updating your nginx conf... NOTE: any http requests will be forced to take https from below and to only www. so make changes if your app supports without www

server {
    server_name truejet.in www.truejet.in;
    return 301 https://$server_name$request_uri;
}

server 
{
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server ipv6only=on;

    server_name www.truejet.in truejet.in;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_certificate /etc/letsencrypt/live/www.truejet.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.truejet.in/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/www.truejet.in/fullchain.pem;
    ssl_dhparam /etc/letsencrypt/live/www.truejet.in/dhparam.pem;

    client_max_body_size 5M;

    location / {
        proxy_buffering off;
        proxy_pass http://0.0.0.0:5000;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Referer "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-SSL on;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
    }

    location ~ /.well-known {
        allow all;
        # You can add the path to the Challenge
        #root /usr/share/nginx/html;
    }

    resolver 8.8.8.8 8.8.4.4 valid=300s;
}