# Allow SSL / HTTPS for your Discourse Docker setup

**URL:** https://meta.discourse.org/t/allow-ssl-https-for-your-discourse-docker-setup/13847
**Category:** Self-Hosting
**Tags:** docker, how-to, advanced-setup
**Created:** [March 18, 2014, 11:45pm UTC](https://meta.discourse.org/t/allow-ssl-https-for-your-discourse-docker-setup/13847 "2014-03-18T23:45:27Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Discourse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/discourse/32/148734_2.png) [@Discourse](https://meta.discourse.org/u/Discourse)
#### Post date: [March 18, 2014, 11:45pm UTC](https://meta.discourse.org/t/allow-ssl-https-for-your-discourse-docker-setup/13847/1 "2014-03-18T23:45:27Z")

</div>

> [@](#):
>
> ### :warning: **STOP** :warning:
> 
> This guide is for advanced setups only, and should only be used if [Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/setting-up-lets-encrypt/40709) does not work for your setup. Let’s Encrypt provides a free SSL certificate, and automatically renews prior to expiration.

This guide is likely out of date as there are now very few reasons not to use the built-in Let’s Encrypt certificate that Just Works. See also:

> [@sam](#):
>
> I do however recommend just forgetting about this mess and going with lets encrypt.

2023-04-10 @pfaffman says: This is left here mostly for historical purposes.

So you’d like to enable SSL for your Docker-based Discourse setup? Let’s do it!

This guide assumes you used all the [standard install](https://meta.discourse.org/t/142537?silent=true) defaults – a container configuration file at`/var/discourse/containers/app.yml` and Discourse docker is installed at: `/var/discourse`

### Buy a SSL Certificate

Go to [namecheap](https://www.namecheap.com) or some other SSL cert provider and purchase a SSL cert for your domain. Follow all the step documented by them to generate private key and CSR and finally get your cert. I used the apache defaults, they will work fine.

Keep your private key and cert somewhere safe.

### Place the Certificate and Key

Get a signed cert and key and place them in the `/var/discourse/shared/standalone/ssl/` folder

Private key is:

`/var/discourse/shared/standalone/ssl/ssl.key`

Cert is

`/var/discourse/shared/standalone/ssl/ssl.crt`

**File names are critical** do not stray from them or your nginx template will not know where to find the cert.

Have a look at your `app.yml` configuration file to see where the shared folder is mounted.

```
volumes:
  - volume:
      host: /var/discourse/shared/standalone
      guest: /shared

```

In essence the files must be located at `/shared/ssl/ssl.key` `/shared/ssl/ssl.crt` inside the container.

For all clients to find a path from your cert to a trusted root cert (i.e., not give your users any warnings), you may need to concatenate the cert files from your provider like so:

```
cat "Your PositiveSSL Certificate" "Intermediate CA Certificate" "Intermediate CA Certificate" >> ssl.crt

```

### Configure NGINX

Add a reference to the nginx ssl template from your `app.yml` configuration file:

```
templates:
  - "templates/postgres.template.yml"
  - "templates/redis.template.yml"
  - "templates/web.template.yml"
  - "templates/web.ratelimited.template.yml"
  - "templates/web.ssl.template.yml"

```

### Configure your Docker Container

Tell your container to listen on SSL

```
expose:
  - "80:80"
  - "443:443"

```

### Bootstrap your Docker Container

Rebuild your app

```plaintext
./launcher rebuild app

```

Profit, you are done!

### Troubleshooting

Be sure to read through the logs using

```plaintext
./launcher logs app

```

If anything goes wrong.

### How this works

The template configures nginx with TLSv1.2 and TLSv1.3, strong cipher suites, HSTS headers, and session ticket settings. It uses nginx config outlets to inject the SSL configuration.

The image has rewrite rules that will redirect any requests on port 80 to https://DISCOURSE\_HOST\_NAME , and will also redirect requests for other hostnames on port 443 to the canonical hostname.

Customising this setup is very easy, see:

> <https://github.com/discourse/discourse_docker/blob/main/templates/web.ssl.template.yml>

You can make a copy of that file and amend the template as needed.

The advantage of using templates and outlets here is that we get to keep all the rest of the Discourse recommended NGINX setup, it changes over time.

### Testing your config

See [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/) to make sure all is working correctly. It is possible for some browsers and OS combinations to be happy with partially configured https, so check it here first.

> Last edited by @JammyDodger 2024-05-26T20:55:34Z
> 
> > **Check document**
> >
> > Perform check on document: