### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 06:02:03 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/1 "2018-07-29T06:02:03Z")
some of our users get this error when they try to open our forum in firefox:
`SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG`
no matter what, they can’t open the forum.there were some thread in stackoverflow, stating that it’s about port 80 rather than port 443:
>
but based on this howto document to [run https using let’s encrypt](https://meta.discourse.org/t/setting-up-lets-encrypt/40709), both ports are already exposed.
does anyone have similar issue? do you have any suggestion how to solve this?
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [29.Июль.2018 07:56:09 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/2 "2018-07-29T07:56:09Z")
I have seen that issue quite frequently when the SSL is not configured properly from the server side.
Are you using the default letsencrypt shipped with discourse docker image or have you installed some kind of reverse proxy in front of your install?
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 12:37:20 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/3 "2018-07-29T12:37:20Z")
Thanks @itsbhanusharma, we are using a reverse proxy using this howto:
> [@Run other websites on the same machine as Discourse](https://meta.discourse.org/t/running-other-websites-on-the-same-machine-as-discourse/17247):
>
> @pfaffman edited this heavily 2022.02.24. Blame me if it’s broken. If you want to run other websites on the same machine as Discourse, you need to set up an extra NGINX or HAProxy proxy in front of the Docker container. NOTE: This is for advanced admins This guide assumes you already have Discourse working - if you don’t, it may be hard to tell whether or not the configuration is working. You cannot use ./discourse-setup to set up Discourse if another server is using port 80 or 443. You will…
as well as cloudflare and let’s encrypt.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [29.Июль.2018 12:38:28 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/4 "2018-07-29T12:38:28Z")
Very first thing to try will be to check if cloudflare is causing this!
What do You get if You disable cloudflare optimizations?
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 13:02:50 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/5 "2018-07-29T13:02:50Z")
👍
inactivating **Rocket Loader™** & \*\* Brotli\*\* does the magic!
inactivation of Brotli makes the page to load, but empty page (removal of the error).
inactivation of rocket loader as well, makes everything work fine.
but then when I open a private browsing with tracking protection window in firefox, I get the same error: `SSL_ERROR_RX_RECORD_TOO_LONG`. is it because of the nature of private windows?
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [29.Июль.2018 13:08:24 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/6 "2018-07-29T13:08:24Z")
> [@Pad\_Pors](#):
>
> is it because of the nature of private windows?
I don’t think so!
I’d still highly doubt it’s cloudflare trying to do funny things with your site!
What SSL mode is your certificate in on the cloudflare side? Is it “flexible” for some reason? If so, try changing to “full” and try again?
SSL settings are under Crypto tab.
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 13:12:31 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/7 "2018-07-29T13:12:31Z")
I see.
no it’s full, changing it to full (strict) doesn’t help either.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [29.Июль.2018 13:13:32 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/8 "2018-07-29T13:13:32Z")
Can You redact identifiable information and post the configuration for your reverse proxy?
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 13:49:17 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/9 "2018-07-29T13:49:17Z")
here is the templates and port at `app.yml`.
and for the `/etc/nginx/sites-enabled/discourse.conf` it looks like this:
I hope this is what you meant.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [29.Июль.2018 13:54:49 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/10 "2018-07-29T13:54:49Z")
It seems like the problem is your _probably_ expired certificates. if I’m not mistaken you’re using the nginx outside the docker container to utilize the certificates originally generated by discourse. What I understand is that those certificates can not be renewed anymore (because we disable the web.ssl template) and hence, that might be causing the issue!
Do you mind following a different guide **or** maybe using cloudflare to manage termination by removing your internal nginx if that doesn’t serves a purpose? because technically there should be only one location that handles the ssl termination and if you use cloudflare then they should be the one handling it not you!
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 13:59:14 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/11 "2018-07-29T13:59:14Z")
I see, to be sure if this is the case: this error only happens only to some firefox sessions, and not all of them. is that ok?
> [@itsbhanusharma](#):
>
> Do you mind following a different guide
is there any howto guide for using https alongside cloudflare? I couldn’t find any, I’d appreciate if you can guide me.
> [@itsbhanusharma](#):
>
> maybe using cloudflare to manage termination by removing your internal nginx if that doesn’t serves a purpose
won’t this cause any further error? I’m also not sure how to use cloudflare for this purpose.
**update** : here is the information of the certificate when the site loads correctly:
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [29.Июль.2018 14:07:44 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/12 "2018-07-29T14:07:44Z")
> [@Pad\_Pors](#):
>
> this error only happens only to some firefox sessions, and not all of them. is that ok?
I can think of a lot of reasons why that might be the case! primary one being that your SSL is being cached with the cloudflare responses.
> [@Pad\_Pors](#):
>
> is there any howto guide for using https alongside cloudflare?
There isn’t a guide to use cloudflare with SSL on your server because that isn’t feasible at all. for SSL thing to happen (in case of letsencrypt anyway) your server needs to say hello on port 80 & 443 which in the case of cloudflare is proxied by their servers so the ACME server doesn’t gets the desired response and SSL creation/renewal fails.
for Site to work in SSL, easiest way is to use the cloudflare template on your server and use their certificate in flexible mode. You can as well remove your nginx server installed on your server and simply open port 80 in for docker. if you need additional security, you can set up firewall to disallow connections from anything other than cloudflare IPs to your server.
> [@Pad\_Pors](#):
>
> won’t this cause any further error?
hmmm … I’m not sure. I’ve never had a good time with cloudflare and discourse. There had been a lot of issues in setting it up and even after I managed to get it up & running, most of the things failed on me because there are a lot of tools in cloudflare which do very aggressive caching and discourse doesn’t likes it.
final choice still would be yours if you have to have cloudflare then use the method I suggested. this is the “_most likely would work_” type of situation but I won’t take any responsibility if cloudflare decides to be funny and doesn’t lets it work.
> [@Pad\_Pors](#):
>
> **update** : here is the information of the certificate when the site loads correctly:
>
> [
> image.png425x520 44.6 KB
> ](https://global.discourse-cdn.com/meta/original/3X/4/9/49e8154f08d5541cf82c0ac3674aeb822649169b.png)
that speaks for itself! this is the cloudflare proxy ssl not the one being served from your server.
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [29.Июль.2018 14:17:00 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/13 "2018-07-29T14:17:00Z")
thanks for your help ❤ , hopefully one last question:
there were people typing [www.padpors.com](http://www.padpors.com) to go to our forum, as a result we used the reverse proxy to redirect `www` to `https`. is there any other way, rather than using nginx out of the docker, to solve this?
---
### Author:  [@Pad\_Pors](https://meta.discourse.org/u/Pad_Pors)
#### Post date: [28.Август.2018 03:32:36 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/14 "2018-08-28T03:32:36Z")
no such error has been reported after we brought back our nginx inside the docker, and [removed the reverse proxy](https://meta.discourse.org/t/site-doesnt-launch-after-bringing-back-nginx-reverse-proxy/94636).
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [12.Апрель.2021 22:50:16 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/15 "2021-04-12T22:50:16Z")
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [12.Апрель.2021 23:36:10 UTC](https://meta.discourse.org/t/ssl-received-a-record-that-exceeded-the-maximum-permissible-length/93392/16 "2021-04-12T23:36:10Z")