VirtualMin and SSL

Product Support

AI-generated summary

A user, alchitry, has installed Discourse on their Virtualmin server and is experiencing issues with enabling force_https. When enabled, login and other operations break, resulting in 403 errors. After researching and disabling force_https via the rails console, the user found that Discourse is using http for some links, causing mixed content warnings. The issue seems to be related to Apache handling SSL, but the user couldn’t find a solution. pfaffman suggested seeking help from Virtualmin users, as it’s not supported in the current community, and offered a potential workaround by clearing browser cache or using an incognito window to disable the 301 redirect.

1

I’ve installed Discourse on my server running Virtualmin following this guide How to install Discourse alongside Virtualmin - Virtualmin - Virtualmin Community

Everything is working (including https) but if I enable force_https in the Discourse settings everything breaks. Login doesn’t work and 403 errors are thrown for a lot of other operations.

I saw the same behavior as Forced https deactivate

I got things working again by disabling force_https via the rails console. However, discourse seems to be using http for some links causing the mixed content warning.

I’d like to enable it.

I think the problem is with Apache handling the SSL stuff instead of Discourse but I couldn’t find anything about configuring one or the other to make them work together.

2

It’s hard to guess since Virtualmin isn’t supported here. You should ask the people who are using Virtualmin if they have solved that problem. Glancing at the topic you linked, though, it appears that everyone else has had trouble with https.

Maybe this is the issue you’re trying to solve? Once your browser has been told to insist on https, it’s hard to change its mind. You might be able to clear your, uh, stuff, to get it to forget the 301 redirect. You can try an incognito window or another browser.

Discourse won’t work without https, though, so you likely still won’t have a functioning site if you do manage to deactivate https.