I have a WordPress install using a Comodo SSL certificate. I have the WordPress HTTPS plugin installed and I'm using the AZ theme, and the admin is set to load over HTTPS. So far so good.
On the theme customizer, I get a perpetual loading icon (not to be confused with a WSOD). The AJAX call that brings back the homepage content is empty, save for the
WP_CUSTOMIZER_SIGNATURE token. That is all the response includes. When I disable the WordPress HTTPS plugin (or otherwise disable loading the admin over SSL), the customizer works great. Disabling/enabling other plugins has no effect. This occurs with the stock Twenty Fifteen theme as well (pictured below).
Here is a screenshot of what I'm seeing in Firebug (and is reproducible across browsers, as well as on Browserstack VMs):
In case it's relevant, the site is hosted on a DigitalOcean droplet, using ServerPilot. I have other WordPress sites hosted on the same droplet, and the other SSL-enabled one exhibits the same behavior.
ModSecurity is not installed, to my knowledge, and I'm getting a 200 status code so I don't think it's this issue.
SHA-1 messaging appears to be a false positive, so far as I can tell (and I don't think Firefox is yet at the point of blocking content based on
SHA-1 usage anyhow?). I don't think it's
zlib.output_compression bug either, as I have turned it off explicitly to test, and attempted the fix listed in that ticket, which didn't work.
I haven't found anything that quite matches my problem, which makes me think there is something stupid I have overlooked. Any help is greatly appreciated, and please let me know what additional information may be helpful.