HTTPS launches always result in an invalid signature.

[ryanucode]

We are using this library with a LTI application that interfaces with the aNewSpring LMS. Using the same key, secret, and launch url (with the exception of http: and https:) results in the HTTP launch being valid, while the HTTPS launch is invalid.

The same result can be reproduced using the official IMS Consumer Emulator.

[omsmith]

Have you seen #55 #43 and #28? Essentially, if you're being a reverse proxy / load balancer, you should enable trusting X-Forwarded-Proto in your application stack.

If that's not the case, please let me know.