# TLS cert expiry take 2
**URL:** https://meta.discourse.org/t/tls-cert-expiry-take-2/394619
**Category:** Self-hosting
**Created:** [29 januari 2026 om 01:51 UTC](https://meta.discourse.org/t/tls-cert-expiry-take-2/394619 "2026-01-29T01:51:16Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@fuse](https://meta.discourse.org/u/fuse)
#### Post date: [29 januari 2026 om 01:51 UTC](https://meta.discourse.org/t/tls-cert-expiry-take-2/394619/1 "2026-01-29T01:51:16Z")
Doing a manual rebuild from command line as it appears certificates expired again.
Sharing in case someone else is experiencing this.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [29 januari 2026 om 10:29 UTC](https://meta.discourse.org/t/tls-cert-expiry-take-2/394619/2 "2026-01-29T10:29:05Z")
It shouldn’t happen again. There was a fix in December:
> [@Discourse failure to renew certificate](https://meta.discourse.org/t/discourse-failure-to-renew-certificate/385148/22):
>
> Ah thanks for the confirmation and the reports - Nat was able to triage this and found there was a quote in the script that needed escaping. Let us know if the next renewal goes better.
---
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [29 januari 2026 om 16:30 UTC](https://meta.discourse.org/t/tls-cert-expiry-take-2/394619/3 "2026-01-29T16:30:14Z")
I had a cert expire on one of my two forums. The other one was OK. The main difference I can identify is that the failing forum went through a web update whereas the OK forum stalled on the web update and I chose to recover by doing a CLI update.
Previous version: 2025.12.0-latest (b10ea7929f) as noted on 28 Nov.
On 23rd Dec I patched the nginx script on the forum which turned out later to fail. But I didn’t restart or signal nginx so perhaps that was pointless. I didn’t do anything on the forum which later didn’t fail.
It’s possible I broke it rather than fixed it. But here’s the transcript:
```plaintext
root@ubuntu-4gb-hel1-1-app:/# docker exec -it app bash
root@ubuntu-4gb-hel1-1-app:/# sed -i '/301/s/;/$request_uri;/' /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
root@ubuntu-4gb-hel1-1-app:/# cat /etc/nginx/conf.d/outlets/beforeserver/20-redirect-http-to-https.conf
server {
listen 80;
listen [::]:80;
location ~ /.well-known {
root /var/www/discourse/public;
allow all;
}
return 301 https://forum.example.com$request_uri;
}
```
On 1 Jan I updated both forums, one in web the other in CLI.
On 19 Jan or possibly 20 Jan the cert on the failing forum expired and the forum was inaccessible on the web.
When I noticed, I rebooted the host - didn’t do anything else - and a new cert appeared:
Issued On Tuesday, 20 January 2026 at 12:04:25
Very very oddly, it seems that the file I patched has been reverted to an unpatched state, at the time of the reboot, even though this server - both servers - have been updated. I’d like to understand how that happened.
```plaintext
root@ubuntu-4gb-hel1-1:~# docker exec -it app bash
root@ubuntu-4gb-hel1-1-app:/# ls -l /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
-rw-r--r-- 1 root root 173 Jan 20 13:05 /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
root@ubuntu-4gb-hel1-1-app:/# cat /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
server {
listen 80;
listen [::]:80;
location ~ /.well-known {
root /var/www/discourse/public;
allow all;
}
return 301 https://forum.techshedfrome.org;
}
```
For completeness, the server that’s OK looks like this:
```plaintext
root@rc-debian-hel:~# docker exec -it app bash
root@rc-debian-hel-app:/# ls -l /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
-rw-r--r-- 1 root root 185 Jan 1 19:57 /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
root@rc-debian-hel-app:/# cat /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
server {
listen 80;
listen [::]:80;
location ~ /.well-known {
root /var/www/discourse/public;
allow all;
}
return 301 https://retrocomputingforum.com$request_uri;
}
```
That working site appears to have got a new cert at rebuild or reboot time:
> Issued On Thursday, 1 January 2026 at 18:59:22
> Expires On Wednesday, 1 April 2026 at 19:59:21
Both are now running
```plaintext
Discourse 2026.01.0-latest - https://github.com/discourse/discourse version a9008966f0b339b5a00c1629bc61eb2ff8ad812a
```