title: Mixed content: Static resources use HTTP instead of HTTPS during WordPress installation
body: <p>I have an <a href="https://www.example.com" rel="nofollow noreferrer">https://www.example.com</a> working with WordPress normally. All the assets are loaded correctly over HTTPS.</p>
  
  <p>But that's not the same with <a href="https://sub.example.com" rel="nofollow noreferrer">https://sub.example.com</a> (the SSL certificate includes this subdomain) and apparently, there's no issue with the certificate but all the assets are <em>redirected</em> to HTTP.</p>
  
  <p>When I visit <a href="https://sub.example.com/wordpress/" rel="nofollow noreferrer">https://sub.example.com/wordpress/</a> to proceed with the setup, it redirects me correctly to <a href="https://sub.example.com/wordpress/wp-admin/setup-config.php" rel="nofollow noreferrer">https://sub.example.com/wordpress/wp-admin/setup-config.php</a> but all the assets are loaded with HTTP, like:</p>
  
  <pre><code>http://sub.example.com/wordpress/wp-includes/css/buttons.min.css?ver=4.8.2
  </code></pre>
  
  <p>When it should be:</p>
  
  <pre><code>https://sub.example.com/wordpress/wp-includes/css/buttons.min.css?ver=4.8.2
  </code></pre>
  
  <p>I checked for <code>.htaccess</code> and also set <code>AllowOverride</code> to <code>None</code> for the entire folder (applied to the parent folders), so I think we can discard <code>.htaccess</code> redirects. Any ideas? This doesn't happen with the main domain (which is running on the same server).</p>
  
  <p>My virtual hosts:</p>
  
  <pre><code>&lt;IfModule mod_ssl.c&gt;
      # This is the one that works just fine
      &lt;VirtualHost _default_:443&gt;
          ServerAdmin webmaster@localhost
          ServerName example.com
  
          DocumentRoot /var/www/example.com
  
          SSLProtocol all -SSLv2 -SSLv3
          SSLHonorCipherOrder On
          SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
  
          ErrorLog ${APACHE_LOG_DIR}/error.log
          CustomLog ${APACHE_LOG_DIR}/access.log combined
  
          SSLEngine on
  
          # Certificate Files Placeholders, but these are the files I set and all of them exist.
          SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
          SSLCertificateKeyFile   /etc/ssl/private/ssl-cert-snakeoil.key
          SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
          SSLCACertificateFile    /etc/apache2/ssl.crt/ca-bundle.crt
  
          &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
                  SSLOptions +StdEnvVars
          &lt;/FilesMatch&gt;
          &lt;Directory /usr/lib/cgi-bin&gt;
                  SSLOptions +StdEnvVars
          &lt;/Directory&gt;
  
          BrowserMatch "MSIE [2-6]" \
                  nokeepalive ssl-unclean-shutdown \
                  downgrade-1.0 force-response-1.0
          BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
      &lt;/VirtualHost&gt;
  
      # And this (and any other sudomain I add) behaves like the described above
      &lt;VirtualHost *:443&gt;
          ServerName  sub.example.com
          DocumentRoot /var/www/sub/
  
          # It doesn't matter if I enable these or not, I get the same result.
          # SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
          # SSLCertificateKeyFile   /etc/ssl/private/ssl-cert-snakeoil.key
          # SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
          # SSLCACertificateFile    /etc/apache2/ssl.crt/ca-bundle.crt
      &lt;/VirtualHost&gt;
  &lt;/IfModule&gt;
  
  # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
  </code></pre>
  
  <p>I set the <code>AllowOverride</code> directive in <code>apache2.conf</code> which other than that directive, remains the same as default.</p>
  
  <p>The server is running Apache 2.4.10 in Debian 8.9</p>