Let's encrypt failing for IP behind firewall

[Simon_Manning]

@Qcloud1223

Also, since sshd.template.yml is deprecated, I have to manually edit /etc/nginx/conf.d/discourse..conf to modify ssl_certificate and ssl_certificate_key to point to /shared/ssl/ssh.crt and /shared/ssl/ssh.key (the default value is /shared/ssl/<domain name>.cer)

You should just need to use the web.ssl template (and not the web.letsencrypt.ssl template). The sample yml has the following lines:

  ## Uncomment these two lines if you wish to add Lets Encrypt (https)
  #- "templates/web.ssl.template.yml"
  #- "templates/web.letsencrypt.ssl.template.yml"

Just uncomment the first one:

  ## Uncomment these two lines if you wish to add Lets Encrypt (https)
  - "templates/web.ssl.template.yml"
  #- "templates/web.letsencrypt.ssl.template.yml"

That will set up nginx for SSL using /shared/ssl/ssl.crt and /shared/ssl/ssl.key. With that, you just need to make sure you have a valid certificate and key at those paths. Assuming you’ve installed to the standard location, the path to that directory on the host system is /var/discourse/shared/standalone/ssl/.