Let's encrypt's Nginx-https no small lock

1, using Let's encrypt encryption after nginx, access to the time, found no small lock, Chrome:

On Firefox browser:

You'll see the information above, because CSS, graphics, or JavaScript are still available via HTTP, and can be modified in a simple way, by the-uir parameter of Let's encrypt. This header applies to resources hosted under your own domain name or hosted by a third party, and you must ensure that resources are accessible.

Add the following configuration to the Nginx configuration file server segment or the location side:

Dd_header strict-transport-security "max-age=15768000; Preload  always;add_header content-security-policy upgrade-insecure-requests;


Use!!!!! with caution

Let's encrypt's Nginx-https no small lock