# Let’s Encrypt problem after upgrading to 1.9.0.beta3
**URL:** https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785
**Category:** Bug
**Created:** [2017 年7 月 7 日 04:46 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785 "2017-07-07T04:46:53Z")
**Posts on this page:** 15
**Page:** 1
### 作者：  [@saluzi](https://meta.discourse.org/u/saluzi)
#### 发布日期： [2017 年7 月 7 日 04:46 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/1 "2017-07-07T04:46:53Z")
After upgrading to 1.9.0.beta3 , the SSL(Let’s Encrypt) rating has changed from A+ to A，the problem is HSTS.
Thanks very much
---
### 作者：  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### 发布日期： [2017 年7 月 7 日 04:49 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/2 "2017-07-07T04:49:41Z")
What is the problem with HSTS?
---
### 作者：  [@saluzi](https://meta.discourse.org/u/saluzi)
#### 发布日期： [2017 年7 月 7 日 04:57 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/3 "2017-07-07T04:57:20Z")
Using the [ssllabs.com](http://ssllabs.com) query, `HTTP Strict Transport Security (HSTS) with long duration deployed on this server` this sentence disappears . Thank you.
---
### 作者：  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### 发布日期： [2017 年7 月 7 日 05:17 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/4 "2017-07-07T05:17:06Z")
The [default HSTS configuration](https://github.com/discourse/discourse_docker/blob/master/templates/web.letsencrypt.ssl.template.yml#L92) is compliant with the SSL Labs recommendations. What site are you testing, and what changes have you made to the default `discourse_docker` templates?
---
### 作者：  [@saluzi](https://meta.discourse.org/u/saluzi)
#### 发布日期： [2017 年7 月 7 日 05:26 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/5 "2017-07-07T05:26:13Z")
I have nothing to change, completely default. My website is [https://www.xxxx.com/](https://www.xxxx.com/)
---
### 作者：  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### 发布日期： [2017 年7 月 7 日 05:33 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/6 "2017-07-07T05:33:04Z")
Your site is not sending an HSTS header at all. You’re also sending a header that was reverted from the default template nine days ago. Whatever you’re doing over there, it isn’t what we recommend.
---
### 作者：  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### 发布日期： [2017 年7 月 7 日 05:56 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/7 "2017-07-07T05:56:53Z")
Working fine on my self hosted by the book install of Discourse
---
### 作者：  [@saluzi](https://meta.discourse.org/u/saluzi)
#### 发布日期： [2017 年7 月 13 日 10:26 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/8 "2017-07-13T10:26:13Z")
---
### 作者：  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### 发布日期： [2017 年7 月 13 日 17:55 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/9 "2017-07-13T17:55:55Z")
Hmm, plausible, as I did a command line rebuild yesterday cc @falco.
---
### 作者：  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### 发布日期： [2017 年7 月 13 日 22:04 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/11 "2017-07-13T22:04:45Z")
Can confirm `discourse.codinghorror.com` is no longer sending a HSTS header _at all_:
```
$ wget -O /dev/null -S https://discourse.codinghorror.com -q
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 13 Jul 2017 22:04:15 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Discourse-Route: list/latest
Cache-Control: no-store, must-revalidate, no-cache, private
X-Discourse-Cached: true
X-Request-Id: f40d4ea9-375a-4a9e-b6e1-c7500ffa194f
X-Runtime: 0.002585
X-Discourse-TrackView: 1
Referrer-Policy: no-referrer-when-downgrade
```
---
### 作者：  [@Falco](https://meta.discourse.org/u/Falco)
#### 发布日期： [2017 年7 月 13 日 22:06 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/12 "2017-07-13T22:06:03Z")
Yeah, I made a mistake when I added the `Referrer-Policy` header.
nginx add\_header lack of support for inheritance got me there.
Will fix soon.
---
### 作者：  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### 发布日期： [2017 年7 月 13 日 22:07 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/13 "2017-07-13T22:07:12Z")
> [@Falco](#):
>
> nginx add\_header lack of support for inheritance got me there.
Awwwwwwww yeah… we’ve all been to _that_ circle of hell.
---
### 作者：  [@Falco](https://meta.discourse.org/u/Falco)
#### 发布日期： [2017 年7 月 14 日 03:03 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/14 "2017-07-14T03:03:25Z")
Rebuild a site to test this in action:
[https://github.com/discourse/discourse\_docker/commit/42504d319c1c7abe8501e8db4efcf1707aaaa240](https://github.com/discourse/discourse_docker/commit/42504d319c1c7abe8501e8db4efcf1707aaaa240)
---
### 作者：  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### 发布日期： [2017 年7 月 14 日 09:01 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/15 "2017-07-14T09:01:19Z")
It works!
Thanks for the report @saluzi this was a definite regression.
---
### 作者：  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### 发布日期： [2017 年7 月 14 日 09:01 UTC](https://meta.discourse.org/t/let-s-encrypt-problem-after-upgrading-to-1-9-0-beta3/65785/16 "2017-07-14T09:01:24Z")