Getting Cloudflare 521 Error After Upgrade to 3.5.0.beta8-dev

Product Support

AI-generated summary

After upgrading to Discourse 3.5.0.beta8-dev, LW2333 began experiencing Cloudflare 521 errors (“Web server is down”) when using Full (Strict) SSL mode, though switching to Flexible mode temporarily resolved the issue. They confirmed using a Cloudflare Origin Certificate (not Let’s Encrypt), stored in /var/discourse/shared/standalone/ssl/, and rebuilt the app after verifying the config. LotusJeff reported no issues on the same version with Full (Strict) and suggested checking Let’s Encrypt setup or firewall rules, noting that 521 often indicates the server isn’t properly configured for HTTPS. LW2333 clarified they’re not using Let’s Encrypt and shared their app.yml config, which includes cloudflare.template.yml and web.ssl.template.yml. LotusJeff reminded them that Cloudflare certs typically expire every 90 days (though LW2333 confirmed theirs are valid for 15 years and tried regenerating them without success). LW2333 then asked if switching to Let’s Encrypt would resolve the issue, to which LotusJeff advised uncommenting both the Let’s Encrypt template and setting LETSENCRYPT_ACCOUNT_EMAIL in app.yml, while cautioning that manual SSL customizations must be reverted. They also recommended monitoring the rebuild process for Let’s Encrypt errors.

1

Hi everyone,

After updating my Discourse site to 3.5.0.beta8-dev, I’m suddenly getting a 521 “Web server is down” error when accessing the site through Cloudflare. This is unexpected since I had previously configured it according to this guide, and it had been working perfectly until now.

Then I tried changing the SSL/TLS encryption mode in Cloudflare from Full (Strict) to Flexible, and the site loaded again.

Does anyone know why this might be happening after the update?
Is there something new in 3.5.0.beta8-dev that could affect Cloudflare compatibility or HTTPS handling?

Any help or suggestions would be greatly appreciated!

Thanks in advance!

2

I am running 3.5.0.beta8-dev with Full (strict) SSl with Cloudflare and do not have any issues.

A couple of things to check:

  • Check your Let’s Encrypt - Review your upgrade log and validate everything was rebuilt correctly.
  • Check for any external firewall changes (DigitalOcean provides external firewalls)

The 521 and switching to Flexible indicates your server is not set up with HTTPS.

3

Thanks for the suggestions! @LotusJeff

I’ve checked my SSL setup, and I’m not using Let’s Encrypt, I generated an Origin Certificate from Cloudflare, and placed the key and cert here:

I did a full rebuild after checking. But I’m still getting a 521 error when Cloudflare is set to Full (Strict).

Here’s the template section from my app.yml for reference:

templates:
  - "templates/postgres.template.yml"
  - "templates/redis.template.yml"
  - "templates/web.template.yml"
  - "templates/web.ratelimited.template.yml"
  ## Uncomment these two lines if you wish to add Lets Encrypt (https)
  - "templates/web.ssl.template.yml"
  # - "templates/web.letsencrypt.ssl.template.yml"
  - "templates/cloudflare.template.yml"

expose:
  - "80:80"   # http
  - "443:443" # https

Thanks again for taking the time to help!

4

Working from memory, cloudflare certs have a 90 day duration. This will require you to create new certs every 3 months. Do you remember how old your certs are?

The default setting is to use Let’s Encrypt. The system will auto renew your certs for you. One less thing to manage manually.

5

Cloudflare now privide Certificates that valid for up to 15 years, mine is still within the valid period.

image
image1995×286 28 KB

That said, just to be sure, I also tried generating a new certificate and replaced the existing one, but I still got the same problem.

If I want to switch back to the default setup using Let’s Encrypt,
is it enough to simply:

  1. Uncomment this line in app.yml:
- "templates/web.letsencrypt.ssl.template.yml"
  1. And set Cloudflare’s SSL mode to Full?
6

I have never made the transition from private certificates to Let’s Encrypt with Discourse, and with that said…

Within the app.yml, you will need to uncomment in two locations:

  1. Template line for - "templates/web.letsencrypt.ssl.template.yml"
  2. The Let’s Encrypt account email:
## If you added the Let's Encrypt template, uncomment below to get a free SSL certificate
  LETSENCRYPT_ACCOUNT_EMAIL: <add your email address here>

If you made any other manual changes to templates for custom SSL certificates, they will need to be reverted to the standard settings.

The Let’s Encrypt component is located towards the end when you rebuild the app. Keep an eye out for it and see if you receive any error codes.