# SSL LetsEncrypt renewal not working (due to an extra reverse proxy on the outside)
**URL:** https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236
**Category:** Self-hosting
**Created:** [September 16, 2020, 3:03pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236 "2020-09-16T15:03:30Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@ti0](https://meta.discourse.org/u/ti0)
#### Post date: [September 16, 2020, 3:03pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/1 "2020-09-16T15:03:30Z")
The cert for my discourse instance expired today, and it’s giving an error in the browser. I tried running the renewal manually as per:
> [@How to force letsencrypt cert renewal](https://meta.discourse.org/t/how-to-force-letsencrypt-cert-renewal/143223/6):
>
> You’re right, I did not check all my domains, I assumed all were concerned, but the one with Discourse can be ignored. That’s said, I’ve also figured out how to force renew: cd /var/discourse ./launcher enter app "/shared/letsencrypt"/acme.sh --cron --home "/shared/letsencrypt" --force exit I don’t know if there is a more direct way, but it worked after refreshing website cache.
It showed that the cert renewed, I can see it in the /shared/letsencrypt folder and it renewed correctly. I restarted nginx within docker. I did a rebuild of the instance, even after that it appears to be sending the old certificate.
I checked the domain with several sites, all say that the cert is expired, so it’s not just local.
Am I missing something ?
---
### Author:  [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [September 16, 2020, 3:11pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/2 "2020-09-16T15:11:01Z")
I just did the same instructions 15 days ago.
```plaintext
cd /var/discourse
./launcher enter app
"/shared/letsencrypt"/acme.sh --cron --home "/shared/letsencrypt" --force
exit
```
The first thing I learned was that if you view the certificate with Chrome it may show invalid when in fact it is valid. See: [Chrome / Chromium bug: SSL certificates show incorrect (expired) dates](https://meta.discourse.org/t/chrome-chromium-bug-ssl-certificates-show-incorrect-expired-dates/163394)
I then tried
```plaintext
me@site:/var/discourse$ sudo ./launcher rebuild app
```
which did not work and finally
```plaintext
sudo reboot
```
The site was then working as expected.
* * *
While I note the step about `rebuild` I am not sure if it is needed, but it was a step I did along the way.
---
### Author:  [@ti0](https://meta.discourse.org/u/ti0)
#### Post date: [September 16, 2020, 3:12pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/3 "2020-09-16T15:12:25Z")
After trying for hours, and just after I posted this, I realized that because I’m using a multi-site deployment, with an nginx reverse-proxy, I had to also restart the outer nginx server, and it started working instantly.
I’m going to mark this as the answer, just in case someone lands up in this situation.
---
### Author:  [@ti0](https://meta.discourse.org/u/ti0)
#### Post date: [September 16, 2020, 3:13pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/4 "2020-09-16T15:13:38Z")
> [@EricGT](#):
>
> `sudo reboot`
I think the final `sudo reboot` may have worked for you because it restarted nginx - which is what I posted in my solution above.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 16, 2020, 3:18pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/5 "2020-09-16T15:18:23Z")
> [@EricGT](#):
>
> The first thing I learned was that if you view the certificate with Chrome it may show invalid when in fact it is valid.
Couple notes about this:
- in the referenced situation, the browser _doesn’t actually show it as invalid_ in the address bar
- depending on OS, it may not complain about the certificate date if you look at it
---
### Author:  [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [September 16, 2020, 3:21pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/6 "2020-09-16T15:21:14Z")
Did you find the root cause of why the certificate was not automatically renewing?
On the site I noted it was because it is not in a production mode so all e-mails are suspended, including the e-mails that would renew the the certificate.
The reason the e-mail was suspended is that it is part of the process of restoring the database, in the specific case it was restored from a different instance of Discourse.
The e-mail is disabled so that two sites are not sending out the same e-mails.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 16, 2020, 3:23pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/7 "2020-09-16T15:23:22Z")
> [@EricGT](#):
>
> including the e-mails that would renew the the certificate
the only way that email is involved in the process _at all_ is that LE might send you a warning if your cert is expiring and you haven’t renewed
---
### Author:  [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [September 16, 2020, 3:25pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/8 "2020-09-16T15:25:03Z")
> [@supermathie](#):
>
> the only way that email is involved in the process _at all_ is that LE might send you a warning if your cert is expiring and you haven’t renewed
OK. Thanks. Now I have to find the root cause as to why the certificate did not automatically renew.
Any reason why a certificate would not renew?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 16, 2020, 3:28pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/9 "2020-09-16T15:28:26Z")
> [@EricGT](#):
>
> Any reason why a certificate would not renew?
Generally customisations the unexpectedly break the process. I would open a new topic showing your details and what you’ve done.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [October 16, 2020, 3:28pm UTC](https://meta.discourse.org/t/ssl-letsencrypt-renewal-not-working-due-to-an-extra-reverse-proxy-on-the-outside/164236/10 "2020-10-16T15:28:26Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.