micoHuang is experiencing a “BAD CSRF” error after enabling “force https” on a non-standard Discourse installation using custom SSL files (xxx.pem and xxx.key). They’re unsure if the issue stems from SSL configuration or elsewhere and cannot disable “force https” via the web interface. southpaw acknowledges the lack of prior responses and suggests reviewing a related troubleshooting topic for potential clues. They also propose, cautiously, that the method used to enable force https might be reversed by setting the value to false, but advise waiting for further community input before attempting it. The issue appears tied to SSL setup and CSRF token validation under HTTPS, possibly due to certificate format mismatches (pem vs crt) or misconfigured headers. No definitive fix is offered yet, but diagnostic paths and a potential workaround are outlined.
Hello, When I enabled “force https” and many functions reported “BAD CSRF”, I was not sure if my ssl configuration was correct or if my problem was somewhere else. I used a non-standard installation and used “./launcher rebuild app” to customize the installation. My ssl file is xxx.pem and xxx.key, I am not sure whether the pem file is OK, I see the official document is xxx.crt, currently I cannot cancel “force https” on the page, what should I do?
Hi @micoHuang,
I’m sorry to see no one has any suggestions for you. I don’t have a solution, but I wanted to be sure you had seen this topic: Troubleshooting "BAD CSRF" error on initial site setup?.
It’s not identical to your situation, but there may be something there that gives you some help.
The topic I linked above has a reply that describes how to enable force https… I’m wondering if using those instructions with false instead of true might allow you to disable it? (Note: Please wait to see if anyone chimes in before you try that. 
)