# Unknow error "BAD CSRF"

**URL:** https://meta.discourse.org/t/unknow-error-bad-csrf/260104
**Category:** Support
**Created:** [March 31, 2023, 1:03pm UTC](https://meta.discourse.org/t/unknow-error-bad-csrf/260104 "2023-03-31T13:03:54Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![micoHuang](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@micoHuang](https://meta.discourse.org/u/micoHuang)
#### Post date: [March 31, 2023, 1:03pm UTC](https://meta.discourse.org/t/unknow-error-bad-csrf/260104/1 "2023-03-31T13:03:54Z")

</div>

Hello, When I enabled “force https” and many functions reported “BAD CSRF”, I was not sure if my ssl configuration was correct or if my problem was somewhere else. I used a non-standard installation and used “./launcher rebuild app” to customize the installation. My ssl file is xxx.pem and xxx.key, I am not sure whether the pem file is OK, I see the official document is xxx.crt, currently I cannot cancel “force https” on the page, what should I do?

![image](https://global.discourse-cdn.com/meta/original/4X/5/3/b/53bee0bcc13d427dd79a5380f454e806bc0d0fcb.png)

---

<div class="post-metadata">

### Author: ![southpaw](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/southpaw/32/79352_2.png) [@southpaw](https://meta.discourse.org/u/southpaw)
#### Post date: [April 5, 2023, 2:24pm UTC](https://meta.discourse.org/t/unknow-error-bad-csrf/260104/3 "2023-04-05T14:24:56Z")

</div>

Hi @micoHuang,

I’m sorry to see no one has any suggestions for you. I don’t have a solution, but I wanted to be sure you had seen this topic: [Troubleshooting "BAD CSRF" error on initial site setup?](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059).  
It’s not identical to your situation, but there may be something there that gives you some help.

> [@micoHuang](#):
>
> currently I cannot cancel “force https” on the page

The topic I linked above has [a reply](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059/13) that describes how to _enable_ force https… I’m _wondering_ if using those instructions with `false` instead of `true` might allow you to disable it? (Note: Please wait to see if anyone chimes in before you try that. 😬)