# Discourse deploy on lightsail: "connection refused"
**URL:** https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213
**Category:** Self-hosting
**Created:** [August 15, 2022, 3:35pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213 "2022-08-15T15:35:41Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Chase\_Kanipe](https://meta.discourse.org/u/Chase_Kanipe)
#### Post date: [August 15, 2022, 3:35pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/1 "2022-08-15T15:35:41Z")
Hello,
I recently followed the [install-cloud](https://github.com/discourse/discourse/blob/main/docs/INSTALL-cloud.md) guide to install discourse on an AWS lightsail instance. Despite closely following the instructions and starting from scratch several times I unfortunately get a “connection refused” error when attempting to access my forum.
The steps I followed were:
1. Create a new lightsail instance
2. Assign a static IP address
3. Open port 443
4. Point my subdomain (forum.procedural.audio) to the IP address
5. Follow the discourse installation commands in the guide, including providing an email address for LETS\_ENCRYPT
6. Browsing to my forum… connection refused
Running `./discourse-doctor` outputs that the discourse version at forum.procedural.audio is `NOT FOUND`. I can successfully receive a test email from discourse.
Running `ping forum.procedural.audio` doesn’t receive data back but does find the correct static IP.
I noticed the following errors in the logs
```plaintext
$ ./launcher logs app
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/forum.procedural.audio.cer": PEM_read_bio_X509_AUX() failed (S
SL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
(repeats many more times)
```
So it seems like the problem is SSL related, though I’m unsure how to fix it. In the `shared/standalone/ssl/` directory there are four files
1. `forum.procedural.audio.cer` (file is empty)
2. `forum.procedural.audio.key` (file contains a key)
3. `forum.procedural.audio_ecc.cer` (file is empty)
4. `forum.procedural.audio_ecc.key` (file contains a key)
So I’m not sure if the `.cer` files being empty is part of the problem. I also notice, however, that the logs indicate it is looking for the file at `/shared/ssl/*` instead of `/shared/standalone/ssl/*`, which also seems relevant.
Thanks for your assistance.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [August 15, 2022, 3:50pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/2 "2022-08-15T15:50:46Z")
The problem is that your lightsail instance isn’t contactable externally. That’s what discourse-doctor was telling you - if you only opened port 443 this is probably why.
HTTPS on 443 isn’t going to work _until_ you have a certificate. You don’t have a certificate (and those certificate files are empty) because let’s encrypt was unable to enroll _due_ to the communications issue.
Assuming you assigned a static external address also open port 80 then try again. 80 will need to be open anyhow so that any client which connects via HTTP can be redirected.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [August 15, 2022, 3:54pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/4 "2022-08-15T15:54:03Z")
> [@Chase\_Kanipe](#):
>
> forum.procedural.audio
I just checked and this hostname is invalid. You need to fix that first.
```plaintext
cannot resolve forum.procedural.audio: Unknown host
```
---
### Author:  [@Chase\_Kanipe](https://meta.discourse.org/u/Chase_Kanipe)
#### Post date: [August 15, 2022, 3:54pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/5 "2022-08-15T15:54:14Z")
Ports 22 and 80 are open by default for lightsail instances. So I don’t think opening port 80 is the solution.
---
### Author:  [@Chase\_Kanipe](https://meta.discourse.org/u/Chase_Kanipe)
#### Post date: [August 15, 2022, 3:56pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/6 "2022-08-15T15:56:07Z")
Sorry do you mind elaborating more? In what sense is the hostname invalid?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [August 15, 2022, 3:57pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/7 "2022-08-15T15:57:56Z")
`forum.procedural.audio` doesn’t appear in DNS, or to put it another way the hostname doesn’t resolve to an IP. I’ve just checked via CloudFlare and Google DNS, neither can find that hostname. If I can’t resolve it, then neither can discourse-doctor.
When did you create the ‘a’ record for your server? Have you checked their replication times?
Make sure this is fixed **before** you try to build the server again. Let’s Encrypt gives a finite number of tries to enrol/renew and when you hit that you won’t be able to get a certificate for seven days.
---
### Author:  [@Chase\_Kanipe](https://meta.discourse.org/u/Chase_Kanipe)
#### Post date: [August 15, 2022, 4:07pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/8 "2022-08-15T16:07:02Z")
I’ve had the domain in namecheap for two days, which points to route 53 (the extra layer if indirection is because route 53 doesn’t support .audio domains). The main domain entry has existed for most of those two days. The subdomain record there has existed for about an hour.
If this was the problem then I think running `ping forum.procedural.audio` from my instance would fail to resolve the IP address. But it the IP does resolve.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [August 15, 2022, 4:10pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/9 "2022-08-15T16:10:39Z")
It doesn’t resolve _externally_, Let’s Encrypt uses DNS to ensure the server is what it asserts to be.
```plaintext
ping forum.procedural.audio ✔ 1909 10:59:47
ping: cannot resolve forum.procedural.audio: Unknown host
```
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 15, 2022, 4:13pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/10 "2022-08-15T16:13:34Z")
Hmm. Well [https://dnschecker.org/#A/forum.procedural.audio](https://dnschecker.org/#A/forum.procedural.audio) shows that the name resolves in a bunch of places, so maybe it’s a propagation issue. When I have 1.1.1.1 or 8.8.8.8 look it up, I get no response. `NS-337.AWSDNS-42.COM` does return it though, so you might just need to wait a while.
But `discourse-setup` will try to look up the address and see if it can connect to itself. If that is failing it’s typically either and DNS issue or that ports are not open.
---
### Author:  [@Chase\_Kanipe](https://meta.discourse.org/u/Chase_Kanipe)
#### Post date: [August 21, 2022, 9:57pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/11 "2022-08-21T21:57:13Z")
Hello,
It has been almost a week and I continue to be unable to deploy a forum. Does anyone have additional ideas? Ports 80 and 443 are open. I do not think this is a DNS issue – discourse-doctor does not find the discourse version at localhost (in addition to at forum.procedural.audio). Any help is appreciated.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [August 21, 2022, 10:34pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/12 "2022-08-21T22:34:38Z")
> [@Chase\_Kanipe](#):
>
> I do not think this is a DNS issue
```plaintext
nslookup.exe forum.procedural.audio
Server: dns.google
Address: 8.8.8.8
*** dns.google can't find forum.procedural.audio: Server failed
```
It is a DNS issue.
---
### Author:  [@Chase\_Kanipe](https://meta.discourse.org/u/Chase_Kanipe)
#### Post date: [August 21, 2022, 10:41pm UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/13 "2022-08-21T22:41:42Z")
Hmmm [https://dnschecker.org/#A/forum.procedural.audio](https://dnschecker.org/#A/forum.procedural.audio) shows it has propagated to 31/32 locations. I’ve never heard of DNS records taking over 144 hours to propagate. But now checking [Nslookup.io](https://www.nslookup.io/domains/forum.procedural.audio/dns-records/#cloudflare) I see Cloudflare and Google can’t resolve it, though the authoritative server can.
So I guess I was wrong but I’m unsure what to do about this. I’m unsure why discourse-doctor can’t find the discourse version at localhost.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 22, 2022, 1:28am UTC](https://meta.discourse.org/t/discourse-deploy-on-lightsail-connection-refused/236213/14 "2022-08-22T01:28:23Z")
> [@Chase\_Kanipe](#):
>
> Cloudflare and Google can’t resolve it,
So you have a dns problem.
And if you’ve done lots of rebuilds, you have a let’s encrypt rate limiting issue.