After Discourse installation can’t reach it in browser

installation
21

@Rafeal In the prompt $letsencrypt_status == “ENTER to skip”

@Stephen I just spun up a new CentOS8 VM, switch firewalld to use iptables, installed docker and went through the Discourse install steps from the beginning as in INSTALL-cloud.md. I got the same result – instant disconnect on connections to port 80 and 443. I am not using Let’s Encrypt. I just hit ENTER when I get that prompt.

[root@disctest discourse]# telnet localhost 80
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.
[root@disctest discourse]# ls shared/standalone/ssl/
disctest.nmr.mgh.harvard.edu.cer      disctest.nmr.mgh.harvard.edu_ecc.key
disctest.nmr.mgh.harvard.edu_ecc.cer  disctest.nmr.mgh.harvard.edu.key

[root@disctest discourse]# ls -l shared/standalone/ssl/disctest.nmr.mgh.harvard.edu.cer
-rw-r--r--. 1 root root 0 Sep  4 16:06 shared/standalone/ssl/disctest.nmr.mgh.harvard.edu.cer

[root@disctest discourse]# tail -1 shared/standalone/log/var-log/nginx/error.log
2020/09/04 20:20:37 [emerg] 6186#6186: cannot load certificate "/shared/ssl/disctest.nmr.mgh.harvard.edu.cer": PEM_read_bio_X509_AUX() failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
22

disctest.nmr.mgh.harvard.edu doesn’t appear to be a valid DNS address. Is that the hostname? Is it hosted on the Harvard public net block?

Are you using split horizon?

23

It is in a private network with internal DNS

No, no idea what that is.

24

Ok, so the reason the standard install didn’t behave as expected is because you aren’t using a typical setup.

If your DNS entry is only valid internally, then yes you’re using split DNS. There’s no way for Let’s Encrypt to carry out DNS validation, which is how it decides whether to issue your certificate. Your configuration is very uncommon outside of academic networks.

Split DNS is an advanced configuration, ./discourse-setup isn’t designed for those cases. If you take a look at this doc the beginner install isn’t aimed at you.

1 Like
25

Then you’ll need to edit app.yml by hand and remove the let’s encrypt template

3 Likes