# Let's Encrypt- empty \*.cer files
**URL:** https://meta.discourse.org/t/lets-encrypt-empty-cer-files/135241
**Category:** Self-hosting
**Created:** [December 6, 2019, 8:52am UTC](https://meta.discourse.org/t/lets-encrypt-empty-cer-files/135241 "2019-12-06T08:52:42Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Mark\_Schmucker](https://meta.discourse.org/u/Mark_Schmucker)
#### Post date: [December 6, 2019, 8:52am UTC](https://meta.discourse.org/t/lets-encrypt-empty-cer-files/135241/1 "2019-12-06T08:52:42Z")
I can’t connect to a new [standard 30-minute install](https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md). AWS Lightsail, 2GB memory, Ubuntu 18.04 LTS x64 with :443 open. The problem is that the Let’s Encrypt \*.cer files are empty. Why?
**nginx logs**
> root:/var/log/nginx# ls -ltrh
> -rw-r–r-- 1 www-data www-data 0 Dec 6 05:45 error.letsencrypt.log
> -rw-r–r-- 1 www-data www-data 0 Dec 6 05:45 access.letsencrypt.log
> -rw-r–r-- 1 www-data www-data 1.8M Dec 6 08:19 error.log
>
> tail error.log
> PEM\_read\_bio\_X509\_AUX() failed (SSL: error:0909006C:PEM routines:get\_name:no start line:Expecting: TRUSTED CERTIFICATE)
**The certificate files on the non-working site. Note zero-size files.**
> ls /shared/ssl/ -ltrh
> -rw------- 1 root root 3.2K Dec 6 08:16 test.example.com.key
> -rw-r–r-- 1 root root 0 Dec 6 08:16 test.example.com.cer
> -rw------- 1 root root 302 Dec 6 08:16 test.example.com\_ecc.key
> -rw-r–r-- 1 root root 0 Dec 6 08:16 test.example.com\_ecc.cer
**Compare to the certificate files on a working site**
> ls /shared/ssl/ -ltrh
> -rw-r–r-- 1 root root 3.2K Nov 25 07:41 forum.working.com.key
> -rw-r–r-- 1 root root 3.9K Nov 25 07:41 forum.working.com.cer
> -rw------- 1 root root 302 Nov 29 00:11 forum.working.com\_ecc.key
> -rw-r–r-- 1 root root 3.3K Nov 29 00:11 forum.working.com\_ecc.cer
I’ve rebuilt, rebooted, and tried a different email in LETSENCRYPT\_ACCOUNT\_EMAIL in app.yml.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [December 6, 2019, 12:27pm UTC](https://meta.discourse.org/t/lets-encrypt-empty-cer-files/135241/2 "2019-12-06T12:27:21Z")
I had this happen yesterday and I believe that the problem was that the domain name didn’t resolve to the server (I was using the wrong hostname). `discourse-setup` does a test that should catch that, though.
Delete the ssl and let’s encrypt directories from `/var/discourse/shared/standalone ` after you fix the dns problem.
---
### Author:  [@Mark\_Schmucker](https://meta.discourse.org/u/Mark_Schmucker)
#### Post date: [December 6, 2019, 11:21pm UTC](https://meta.discourse.org/t/lets-encrypt-empty-cer-files/135241/3 "2019-12-06T23:21:42Z")
> [@pfaffman](#):
>
> `discourse-setup` does a test that should catch that, though
Thanks @pfaffman, this fixed it. In my case, when I first ran discourse-setup, I did not have DNS set up yet, so the test failed. At that point I fixed the DNS and hit “n” to retry; this time the test passed and the build continued, but with zero-sized cert files.
I believe this is a bug and will try to repro when I have time. Perhaps the setup just tests whether the cert files exist, but should check whether they are valid, or at least not zero-sized.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [January 5, 2020, 11:30pm UTC](https://meta.discourse.org/t/lets-encrypt-empty-cer-files/135241/4 "2020-01-05T23:30:30Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.