Discourse version at forum.abc.com.au: NOT FOUND

제품 지원 자체 호스팅
1

Discourse installed using official guide on github
Everything went well. but getting 502 error while accessing forum

tried checking rails production logs, and nothing I could see production_error or sidekiq logs

did see this with tail
Creating scope :open. Overwriting existing method Poll.open.
Creating scope :open. Overwriting existing method Poll.open.
Can’t reach ‘/images/welcome/discourse-edit-post-animated.gif’ to get its dimension.

running discourse doctor says

Discourse version at forum.abc.com.au: NOT FOUND

tried disabling ssl and rebuild it, able to access the forum.

There must be problem with ssl, which I can’t figure out. While installing ssl connection to IP resolution succeeded

Pleasae help

2

It sound like before you enabled https you linked to non secure images.

3

@pfaffman Thank you for the reply.

It’s a fresh install. No way we can manually link

4

After digging into all logs, could found this is the error is with LetsEncrypt cert issuance. Anyone facing similar issue might help below.

first I saw this error in Nginx logs

cannot load certificate "/shared/ssl/forum.abc.com.au.cer": PEM_read_bio_X509_AUX() failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE)

then tried to check ssl logs

forum.abc.com.au:Verify error:CAA record for forum.abc.com.au prevents issuance

Before running discourse install script for sub domain we need to verify if main domain is having any CAA records and check the Certificate Authority if it’s not LetsEncrypt (In my case, main domain CAA is comodoca.com) , your letsencrypt certs for discourse won’t be issued

Fix: You need to add CAA record for discourse subdomain as mentioned here
Acme:error:caa :: CAA record for ... prevents issuance - Help - Let's Encrypt Community Support

Delete the old cert files and try rebuilding again

rm -rf /var/discourse/shared/standalone/ssl
rm -rf /var/discourse/shared/standalone/letsencrypt
./launcher rebuild app
5

If you know a way to test for those records that requires no extra software, I’d consider having discourse-setup test for it, but I’ve never seen this before.

Nice work figuring that one out!

6

It’s a fair assumption that if you own a domain and know what CAA is to have been able to configure it that your understand the implications of let’s encrypt.

7

@pfaffman
dig caa {domain.tld} will return the record.
We want to first search if it returns any record
Then if returns whether the issue authority is other than letsencrypt.org

But this is very rare case. Not sure if we want to include that.

8

@Stephen

Correct. if I own a domain, I know what I’m doing with it.
I was helping somebody, this problem might have with hosts that are using cpanel and providing autossls with other providers such as comodo. They add bunch of records by default when they create a site (WordPress) in cpanel

Anyway, this is very rare case, have seen this for the first time

9

We see CAA crop up here occasionally, the default response we get when we point out that they’ve restricted certificate issuance for their entire domain is usually :man_facepalming:t2:

10

@Stephen

This is interesting! ! need to check, I don’t know if we can lock certificate issuance on complete domain.
The restricted certificate issuance for entire domain, meaning all sub domains of it ?

11

If you set a CAA for @ (the domain) then that applies to both the top-level domain and subdomains, you can still add a specific CAA to subdomain.yourdomain.com for a service such as Let’s Encrypt which will restrict the scope for which LE can issue a certificate.

So:

domain.com.    CAA   0 issue "comodoca.com"
sub.domain.dom.    CAA   0  issue "letsencrypt.org"

You can also specify issuewild instead of issue to permit a CA to issue a wildcard certificate, and iodef to associate an email address which will be notified of policy violations.

12

저도 같은 문제를 겪고 있습니다. 해당 명령어로 문제를 해결하지 못했습니다. Cloudflare DNS와 프록시로 변경했는데도 제 경우엔 문제가 계속되고 있습니다.

여러 번 해봤는데 이런 적은 없었습니다. 하지만 저는 확실히 코딩도, 전문가도, 관련 분야도 아닌, 그저 만족스러운 최종 사용자일 뿐입니다. 하지만 정말 짜증나네요.

13

제 추측으로는 Cloudflare를 프록시로 설정해 놓고 재빌드(rebuild)를 충분히 많이 수행하여 Let’s Encrypt의 속도 제한(rate limit)에 도달했고, 이제 인증서를 받으려면 일주일 정도 기다려야 하는 상황인 것 같습니다.

빠르고 간단한 해결 방법은 새로운 서브도메인을 선택하고 Cloudflare를 DNS 전용으로 설정한 뒤 재빌드하는 것입니다. 이 방법으로 작동한다면, 제 속도 제한 추측이 맞다는 뜻이며, 이제 새로운 서브도메인을 좋아하게 되거나 다시 시도할 수 있을 때까지 일주일 정도 기다려야 합니다.

14

솔직히 여쭤볼 것이 있습니다: 재빌드할 때마다 새 인증서를 요청하는 건가요?

15

저도 같은 것에 대해 궁금해하고 있었는데, 요청에 대해서는 확신이 없지만, 유효한 인증서가 발견되면 새로운 인증서가 발급되지 않는 것 같습니다(방금 샌드박스를 다시 빌드했거든요).

16

유효한 인증서가 없다면 그렇습니다.