Unable To Connect/Connection Refused due to https certificates

[GregoryMatthews]

We successfully installed Discourse through DigitalOcean using the following guide:

discourse/docs/INSTALL-cloud.md at main · discourse/discourse · GitHub

Our DNS is fully propagated, and we also installed our SSL CERTS per the following guide:

Allow SSL / HTTPS for your Discourse Docker setup

This guide is likely out of date as there are now very few reasons not to use the built-in Let’s Encrypt certificate that Just Works. See also: 2023-04-10 @pfaffman says: This is left here mostly for historical purposes. So you’d like to enable SSL for your Docker-based Discourse setup? Let’s do it! This guide assumes you used all the standard install defaults – a container configuration file at/var/discourse/containers/app.yml and Discourse docker is installed at: /var/discourse Buy a SS…

When browsing to our Discourse installation via IP or domain name, we get the following message:

This site can’t be reached

XX.XX.XX.XX refused to connect.
Try:
Checking the connection
Checking the proxy and the firewall
ERR_CONNECTION_REFUSED

What could be the problem?

[codinghorror (Jeff Atwood)]

Almost certainly a SSL problem. Try rebuilding with plain HTTP first to make sure everything is working before adding on the complexity of HTTPS.

[pfaffman (Jay Pfaffman)]

Using let’s encrypt is an easy way to get ssl.

[GregoryMatthews]

… thanks for your help.

[kirupa (Kirupa Chinnathambi)]

I am running into this same issue, To rebuild with plain HTTP, does that require just commenting out the SSL template line in app.yml?

[pfaffman (Jay Pfaffman)]

Yes, but browsers that have visited your site will refuse to connect. You really should use https.

[lucasbasquerotto]

For anyone that face it in the future, make sure to not exceed the rate limit of LetsEncrypt:

After initial setup of DigitalOcean droplet, get Refused to Connect error

Just to point out something that happened to me. I used a testing server whose setup is entirely done by ansible, and after I use the site, I destroy it (ansible handles the destruction of the droplets, digital ocean spaces and so on, so that I’m not charged when not using). What happened is that LetsEncrypt have rate limits, and my domain exceeded, so I started receiving the error that the page couldn’t be reached and it was a bit hard to track the reason to the rate limit of certificates (fir…

You can see if it was exceeded in the logs:

./launcher logs app

[BoyanXu]

我在 Chrome 上遇到了完全相同的提示。

就我的情况而言，有几处配置设置错误：有些是 Discourse 的设置，有些是托管服务器的配置。我将我的检查清单贴在这里供你参考：

1. 检查 /var/discourse/containers/app.yml

（参考此帖子：https://meta.discourse.org/t/advanced-setup-only-allowing-ssl-https-for-your-discourse-docker-setup/13847）

确保你要么允许 HTTPS/HTTP（开放 443 端口，取消注释与 SSL 相关的模板配置以及 Let’s Encrypt 相关配置），要么仅允许 HTTP 请求（禁止 443 端口，注释掉与 SSL 相关的模板配置以及 Let’s Encrypt 相关配置）。

如果对 app.yml 进行了任何更改，请运行 ./launcher rebuild app 以激活更新后的配置。

2. 运行 ./launcher logs app。

如果你像我一样频繁无法成功重建一个功能正常的 Discourse 服务器，可能同时请求了过多的 Let’s Encrypt 凭证并超出了其限制。

此时运行 ./launcher logs app 会打印出一个包含 429 错误的 json 响应。

3. 检查你的 ECS 服务器实例的“安全组”设置

在我的案例中，“安全组”本质上是一组已授权开放的端口（例如 80 HTTP、443 HTTPS），用于控制你的服务器与外部网络之间的通信。

请确保开放托管 Discourse 所需的端口。

4. 检查防火墙设置

在我的案例中，第 3 步并未为我开放所需端口，问题出在我的防火墙设置上。

奇怪的是，我从未为服务器配置过防火墙，但在执行以下配置后，这些端口确实被开放了：
apt install firewall-cmd
firewall-cmd --permanent --add-port=20-21/tcp（…以及其他端口）
firewall-cmd --reload

你可以使用一些在线服务检查你的域名已开放端口的状态。

[Jack51 (Jack)]

我也遇到了这个问题——证书请求超过了速率限制。

按照你的第 1 步操作（在 app.yml 中注释掉两个 SSL 模板）并重新构建后，用另一个浏览器打开网站，问题就解决了。

我预计一周后应该就能重新启用 SSL。

[AshNazir]

一周过去了，您成功连接上了吗？