Not able to access site after letsencrypt cert expiry and rebuild due to IPV6

Product Support

AI-generated summary

The user Umashankar_Ankuri encountered an issue with a LetsEncrypt certificate expiry and failed renewal after rebuilding the Discourse app, resulting in an nginx error related to a missing start line in the certificate file. Despite removing SSL files and rebuilding, the problem persisted. The issue was resolved after removing incorrect IPv6 DNS records, as explained by tgxworld and mpalmer. The root cause was identified as a recent change in LetsEncrypt’s behavior, which now prioritizes IPv6 addresses, causing validation failures when IPv6 records are misconfigured. Umashankar_Ankuri confirmed the fix and noted that the site was restored after correcting the DNS settings. mpalmer referenced a related discussion on the Let’s Encrypt community forum regarding this change.

1

Hi,

Please help with below issue.

Letsencrypt cert expired, thought that rebuilding the app would renew the cert ,rebuild done.

Now I get this error nginx: [emerg] PEM_read_bio_X509_AUX("/shared/ssl/javaqna.com.cer") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE)

2

Have you tried to remove the old one (ssl folder) and than rebuild it?

3

Hi Markus,

Thanks for the reply.

i have executed below from the thread

rm -rf /var/discourse/shared/standalone/ssl
rm -rf /var/discourse/shared/standalone/letsencrypt
./launcher rebuild app

not sure what i’m missing :frowning:

4

What do the rebuild logs say?

5

I get the message
[emerg] PEM_read_bio_X509_AUX("/shared/ssl/javaqna.com.cer") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE)

also mentioned in the first thread itself.

Thank you.

6

Hi,

Any one help with this issue. not able to understand what is the error with letsencrypt. tried rebuilding by removing ssl folder cert files serveral times as mentioned above, but no luck.

Thanks.

8

I worked with @Umashankar_Ankuri and this looks like a case where the domain’s IPv6 address was configured incorrectly causing the validation check to fail.

https://github.com/Neilpang/acme.sh/issues/867

@Umashankar_Ankuri can confirm the problem once he fixes his DNS settings.

9

Aaah, yes, that been causing some heartburn over on the LE forums.

10

HI Guo Xiang Tan,

I have fixed problem with IPV6, just removed those records from DNS. and discourse is now up!! we can mark this as fixed.

Just wondering how it worked for the first time!!

Thank you.

11

As per the LE forum topic I linked to earlier, LE recently changed their behaviour from preferring IPv4 to preferring IPv6 records first.