diff --git a/agent/agentclient/client.go b/agent/agentclient/client.go
index 119717d7c..81b659977 100644
--- a/agent/agentclient/client.go
+++ b/agent/agentclient/client.go
@@ -4,7 +4,7 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//	http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -48,7 +48,7 @@ func New(addr string) *HTTPClient {
 // GetTag resolves tag into a digest. Returns ErrTagNotFound if the tag does
 // not exist.
 func (c *HTTPClient) GetTag(tag string) (core.Digest, error) {
-	resp, err := httputil.Get(fmt.Sprintf("http://%s/tags/%s", c.addr, url.PathEscape(tag)))
+	resp, err := httputil.Get(fmt.Sprintf("https://%s/tags/%s", c.addr, url.PathEscape(tag)))
 	if err != nil {
 		if httputil.IsNotFound(err) {
 			return core.Digest{}, ErrTagNotFound
@@ -72,7 +72,7 @@ func (c *HTTPClient) GetTag(tag string) (core.Digest, error) {
 func (c *HTTPClient) Download(namespace string, d core.Digest) (io.ReadCloser, error) {
 	resp, err := httputil.Get(
 		fmt.Sprintf(
-			"http://%s/namespace/%s/blobs/%s",
+			"https://%s/namespace/%s/blobs/%s",
 			c.addr, url.PathEscape(namespace), d))
 	if err != nil {
 		return nil, err
diff --git a/lib/backend/httpbackend/http_test.go b/lib/backend/httpbackend/http_test.go
index a38e5b6d0..a8ea4b714 100644
--- a/lib/backend/httpbackend/http_test.go
+++ b/lib/backend/httpbackend/http_test.go
@@ -4,7 +4,7 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//	http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/lib/backend/registrybackend/tagclient.go b/lib/backend/registrybackend/tagclient.go
index 3439cd141..856c1d3c5 100644
--- a/lib/backend/registrybackend/tagclient.go
+++ b/lib/backend/registrybackend/tagclient.go
@@ -4,7 +4,7 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//	http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/lib/backend/testfs/client.go b/lib/backend/testfs/client.go
index 82ab061f3..2a43f2332 100644
--- a/lib/backend/testfs/client.go
+++ b/lib/backend/testfs/client.go
@@ -86,7 +86,7 @@ func (c *Client) Stat(namespace, name string) (*core.BlobInfo, error) {
 		return nil, fmt.Errorf("pather: %s", err)
 	}
 	resp, err := httputil.Head(
-		fmt.Sprintf("http://%s/files/%s", c.config.Addr, p))
+		fmt.Sprintf("https://%s/files/%s", c.config.Addr, p))
 	if err != nil {
 		if httputil.IsNotFound(err) {
 			return nil, backenderrors.ErrBlobNotFound
@@ -107,7 +107,7 @@ func (c *Client) Upload(namespace, name string, src io.Reader) error {
 		return fmt.Errorf("pather: %s", err)
 	}
 	_, err = httputil.Post(
-		fmt.Sprintf("http://%s/files/%s", c.config.Addr, p),
+		fmt.Sprintf("https://%s/files/%s", c.config.Addr, p),
 		httputil.SendBody(src))
 	return err
 }
@@ -119,7 +119,7 @@ func (c *Client) Download(namespace, name string, dst io.Writer) error {
 		return fmt.Errorf("pather: %s", err)
 	}
 	resp, err := httputil.Get(
-		fmt.Sprintf("http://%s/files/%s", c.config.Addr, p))
+		fmt.Sprintf("https://%s/files/%s", c.config.Addr, p))
 	if err != nil {
 		if httputil.IsNotFound(err) {
 			return backenderrors.ErrBlobNotFound
@@ -145,7 +145,7 @@ func (c *Client) List(prefix string, opts ...backend.ListOption) (*backend.ListR
 	}
 
 	resp, err := httputil.Get(
-		fmt.Sprintf("http://%s/list/%s", c.config.Addr, path.Join(c.pather.BasePath(), prefix)))
+		fmt.Sprintf("https://%s/list/%s", c.config.Addr, path.Join(c.pather.BasePath(), prefix)))
 	if err != nil {
 		return nil, err
 	}
diff --git a/nginx/config/default.go b/nginx/config/default.go
index 032cff19a..bef6a0df9 100644
--- a/nginx/config/default.go
+++ b/nginx/config/default.go
@@ -4,7 +4,7 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//	http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,12 +31,6 @@ var _nameToDefaultTemplate = map[string]string{
 const DefaultClientVerification = `
 ssl_verify_client optional;
 set $required_verified_client 1;
-if ($scheme = http) {
-  set $required_verified_client 0;
-}
-if ($request_method ~ ^(GET|HEAD)$) {
-  set $required_verified_client 0;
-}
 if ($remote_addr = "127.0.0.1") {
   set $required_verified_client 0;
 }
diff --git a/nginx/nginx.go b/nginx/nginx.go
index 3133ecdac..d4e11f6a5 100644
--- a/nginx/nginx.go
+++ b/nginx/nginx.go
@@ -4,7 +4,7 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//	http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,