Discourse failure to renew certificate

[cedric_chin]

@lessLost

In my testing on a vanilla nginx install (1.18.0 but I think it’s the same for 1.26.3), an nginx config line return 301 https://thehostname$request_uri; outside of a location completely overrides any earlier location block before it, rather than being a catch-all. I believe /.well-known/ simply isn’t served on port 80 unless the 301 redirect is specifically for another location such as / at the end of the server block. Could be the same problem as this stackoverflow post?

I can confirm that letsencrypt renewal fails. I’ve been running a self-hosted Discourse install for years, and very strangely renewal failed for me two times in a row over the past couple of months. The second time was this morning, and so I started investigating.

I’ve traced it to the following two commits:

Use Nginx config outlets in templates

And relevant line linked:

https://github.com/discourse/discourse_docker/commit/c9064be6b7a743e3d86dbc69ddaa80701766aa87#diff-b8c95dfe3760424eecc60d21538dbd785f096d46ef95764c60f4b608f40dd536R26

There are two issues, I think.

First, return 301 https://${DISCOURSE_HOSTNAME}$request_uri; gets turned into return 301 https://<MY SERVER NAME> without a $request_uri at the end. I have verified on my self-hosted install, and also on a friend’s self-hosted install that was set up in the past week. I don’t understand how Discourse template works, so I don’t know why it gets dropped.

Second, as @lessLost mentioned, the 301 redirect is outside of the location block. I believe a server level redirect overrides all location blocks. LetsEncrypt uses http for renewals. However, any attempt to curl -I http://YOUR_DOMAIN/.well-known/acme-challenge/test will return a 301 to https, instead of a 404 (which is expected behaviour; we want a 404 not a 301).

I’ve fixed this manually on my self-hosted install, but I expect any update will override my changes. Unfortunately I don’t understand the templates enough to submit a pull request @pfaffman — or I’d do that too.

Edited to add:

I believe this is mistaken —

Let's Encrypt certificate doesn't automatically renew, but rebuilding does trigger the renewal

I recently worked on the le cert renewal. It is the http to https redirect - acme does not handle being told to redirect well at all and by default attempts to connect on the same protocol (http) as it did when it was setup initially Recent updates to the let’s encrypt template should fix these renewals going forward.

I’m fairly certain LetsEncrypt uses http by default (for obvious reasons, if the cert is expired then it can’t renew!) But placing the 301 at the server block level forces all requests to 301 to https, which is inconsistent with this renewal strategy.

Edit 2: Evidence for the http renewal strategy, but you may also Google around to verify this.