Move your Discourse Instance to a Different Server

[Ethsim2 (Ethan)]

Just adding a migration edge case I ran into here, in case it helps someone else.

I hit a Let’s Encrypt/SSL edge case while moving a standalone Discourse instance to a new VPS, so I wrote up the exact diagnosis and recovery steps in case they’re useful to anyone else following this guide.

In my case, nginx inside app would not start because both .cer files in /var/discourse/shared/standalone/ssl/ had become zero-byte files:

PEM_read_bio_X509_AUX() failed

Rebuilding attempted certificate issuance again, and after repeated attempts I hit Let’s Encrypt’s certificate rate limit. Copying the still-valid certificate files from the old server alone was not sufficient, because starting app replaced them with zero-byte files again.

What ultimately fixed it was stopping app and copying both the working /var/discourse/shared/standalone/ssl/ directory and the corresponding /var/discourse/shared/standalone/letsencrypt/ state from the old server, then starting the container again.

I’ve documented the full sequence here:

server_migration_diagnosing_standard_ssl.md

These are diagnostic/recovery notes from this particular migration rather than a replacement for the official migration or HTTPS documentation.

There is also an older Meta topic covering the related zero-byte .cer failure mode:

Let's Encrypt- empty *.cer files

I can’t connect to a new standard 30-minute install. AWS Lightsail, 2GB memory, Ubuntu 18.04 LTS x64 with :443 open. The problem is that the Let’s Encrypt *.cer files are empty. Why? nginx logs root:/var/log/nginx# ls -ltrh -rw-r–r-- 1 www-data www-data 0 Dec 6 05:45 error.letsencrypt.log -rw-r–r-- 1 www-data www-data 0 Dec 6 05:45 access.letsencrypt.log -rw-r–r-- 1 www-data www-data 1.8M Dec 6 08:19 error.log tail error.log PEM_read_bio_X509_AUX() failed (SSL: error:0909006C:PE…