Error after moving from HTTP to HTTPS

Product Support Self-hosting

AI-generated summary

A user, Idan, encountered an error after moving their Discourse forum from HTTP to HTTPS using LetsEncrypt. They followed the installation procedure, but received a “This site can’t be reached” error when trying to access the app via HTTPS or HTTP. The error logs showed a PEM_read_bio_X509_AUX issue, and the certificate file was empty. The acme.sh.log indicated an invalid response from the server. Idan later solved the issue by changing the elastic IP address to point to the HTTPS server instead of the HTTP server, allowing the SSL certificate to be issued.

1

I’ve followed the LetsEncrypt installation procedure for installing SSL for my website.

What I did:

  • Created an image of the original Discourse forum (EC2 AMI)
  • Launched it again
  • Checked that it works (it did)
  • Followed the installation procedure and rebuilt the app
  • Tried to access the app via HTTPS and also via HTTP, neither worked. I got "“This site can’t be reached” error in Chrome

In the logs:

nginx: [emerg] PEM_read_bio_X509_AUX("/shared/ssl/sub.domain.com.cer") failed (SSL: error:0906D06C:PEM routines: PEM_read_bio_no start line: Expecting: TRUSTED CERTIFICATE)

That error repeat itself several times in the log.

When I check the certificate in the /var/discourse/shared/standalone/ssl directory, I see that it is empty.

I also checked the acme.sh.log and there is shows:

Invalid response from http://forum.example.com/.well-known/acme-challenge/xxxxxxxxxxxx-xxxxxxx

I believe that during that command, the server wasn’t accessible via HTTP as it wasn’t even available after the rebuild of the app as well.

I have root access to the AWS EC2 server via SSH.

Help would be greatly appreciated. Thanks.

2

I solved it. The problem was that the elastic IP was directing to the HTTP server, so SSL certificate could not be issued for it. I changed the elastic IP address to point to the HTTPS server and it works.