google chrome - how to set upgrade-insecur-requests based on nginx -

i have changed site https,but used cdn of static files in code. can't work , chrome console show errors this:

mixed content: page @ 'https://a.example.com/static/' loaded on https, requested insecure stylesheet 'http://cdn.bootcss.com/bootstrap/3.3.5/css/bootstrap.min.css'. request has been blocked; content must served on https. 

i have add add_header content-security-policy upgrade-insecure-requests; in nginx configuration file this:

server {     listen 80;     listen 443;     server_name a.example.com;     add_header content-security-policy upgrade-insecure-requests;      if ($scheme != "https") {        return 301 https://$server_name$request_uri;        #rewrite ^ https://$server_name$request_uri? permanent;     }       ssl on;     ssl_certificate /etc/nginx/ssl/example.crt;     ssl_certificate_key /etc/nginx/ssl/example.key;      ssl_session_timeout 5m;      ssl_protocols sslv3 tlsv1 tlsv1.1 tlsv1.2;     ssl_ciphers "high:!anull:!md5 or high:!anull:!md5:!3des";     ssl_prefer_server_ciphers on;      gzip on;     gzip_proxied any;     gzip_types text/plain application/xml application/json;     client_max_body_size 8m;     access_log /var/log/nginx/example.log;     location / {             proxy_pass http://10.10.10.110:5000;             proxy_set_header  x-real-ip  $remote_addr;             proxy_set_header host $host;     }     location ^~ /static/ {              proxy_pass http://10.10.10.110:8888;             proxy_set_header  x-real-ip  $remote_addr;             proxy_set_header host $host;            #proxy_set_header content-security-policy upgrade-insecure-requests;     } 

}

but does't work yet! can tell me how fix this? thx :)

be aware upgrade-insecure-requests not supported in browsers, e.g. safari , ie.

i recommend replace http requests in code. can use // load relative protocol called per:

//cdn.bootcss.com/bootstrap/3.3.5/css/bootstrap.min.css 

that means if opening web application https context, load using https protocol, otherwise use http.