# Oauth2 with fusionauth cert issues
**URL:** https://meta.discourse.org/t/oauth2-with-fusionauth-cert-issues/106324
**Category:** Self-hosting
**Created:** [January 12, 2019, 12:00am UTC](https://meta.discourse.org/t/oauth2-with-fusionauth-cert-issues/106324 "2019-01-12T00:00:17Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@danchik](https://meta.discourse.org/u/danchik)
#### Post date: [January 12, 2019, 12:00am UTC](https://meta.discourse.org/t/oauth2-with-fusionauth-cert-issues/106324/1 "2019-01-12T00:00:17Z")
I am having certificate issue (looks like right after call back returns from oauth2). Discourse and fusionauth are both behind nginx that listens on 443 and proxies to both via http, and fusionauth is the authenticator that discourse uses (with the discourse-basic-oauth2 plugin)
A call to oauth2 goes to fusionauth, but when the redirect url comes back discord throws error:
`Faraday::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)) /usr/local/lib/ruby/2.5.0/net/protocol.rb:44:in connect_nonblock`
technically nginx is the only ssl entry, and proxies to both servers on http… but I am assuming discourse is trying to maybe issue requests to pull user info down, maybe, using curl direct, and that what is throwing the error? Do I need to get inside discourse container and update certs inside (though im at latest discourse version already and system certs are up to date)
thank you
---
### Author:  [@robotdan](https://meta.discourse.org/u/robotdan)
#### Post date: [January 13, 2019, 8:07pm UTC](https://meta.discourse.org/t/oauth2-with-fusionauth-cert-issues/106324/2 "2019-01-13T20:07:09Z")
Hi,
Have you read through this thread, seems like a similar issue.
> [@Discourse OAuth2 Basic](https://meta.discourse.org/t/oauth2-basic-support/33879):
>
> discourse2Summary Discourse OAuth2 Basic supports basic OAuth2 providers, assuming they have a JSON API endpoint where user details can be retrieved by token.open_bookInstall Guide This plugin is bundled with Discourse core. There is no need to install the plugin separately. Features This plugin allows you to use a basic OAuth2 provider as authentication for Discourse. It should work with many providers, with the caveat that they must provide a JSON endpoint for retri…
Assuming this is an Nginx or Discourse configuration issue, but in case FusionAuth is contributing to the issue I’ll offer any help that I can.
- It looks like you’re using a self signed certificate, which is ok, but you likely need to add that to your local certificate store. Alternatively you could use Let’s Encrypt so you don’t need to deal with managing a self signed certificate.
- Have you tried to recreate with an OpenID Connect plugin in addition to the `discourse-basic-oauth2 plugin`?
- Since both FusionAuth and Discourse are behind the proxy, have you configured your redirect in FusionAuth to use `https` or `http`?
If you have any other questions on the FusionAuth configuration I’m happy to help.
Daniel
FusionAuth
---
### Author:  [@danchik](https://meta.discourse.org/u/danchik)
#### Post date: [January 17, 2019, 1:29am UTC](https://meta.discourse.org/t/oauth2-with-fusionauth-cert-issues/106324/3 "2019-01-17T01:29:38Z")
It was the ruby trying to verify peer cert when getting the token and user info after being authorized.
I ended up adding the intermediate cert for our server directly into /usr/lib/ssh/cert.pem via app.yaml
```
-file:
path: /usr/lib/ssh/cert.pem
contents: |
------ the cert part.....
```
though i originally wanted to just copy it from outside into container at the ./launcher rebuild app step but I couldn’t find a way to refer to external file inside app.yaml