thank you ptimo3, your point about fastcgi_param HTTPS on; was exactly it. thank you for including the hint about load balancing.