HTTPS 是 HTTP over Secure Socket Layer，以安全为目标的 HTTP 通道，所以在 HTTPS 承载的页面上不允许出现 http 请求，一旦出现就是提示或报错：
Mixed Content: The page at ‘https://www.taobao.com/‘ was loaded over HTTPS, but requested an insecure image ‘http://g.alicdn.com/s.gif’. This content should also be served over HTTPS.
HTTPS改造之后，我们可以在很多页面中看到如下警报：
image
upgrade-insecure-requests CSP 指令的作用就是让浏览器自动升级请求，防止访问者访问不安全的内容。
该指令用于让浏览器自动升级请求从http到https,用于大量包含http资源的http网页直接升级到https而不会报错.简洁的来讲,就相当于在http和https之间起的一个过渡作用.
html强制让http的访问Https
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"/>
php强制让http的访问Https
header("Content-Security-Policy: upgrade-insecure-requests");
nginx 强制让http的访问Https
server
{
#HTTP_TO_HTTPS_END
ssl_certificate /etc/letsencrypt/live/yogayx.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yogayx.com/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *";
error_page 497 https://$host$request_uri;
}
在经过反复测试后
add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *";
解决了全部问题，即消除全部警告，同时兼容了各种协议资源。
