# Using letsencrypt inside Discourse
**URL:** https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297
**Category:** Self-hosting
**Tags:** letsencrypt
**Created:** [March 22, 2019, 1:09am UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297 "2019-03-22T01:09:55Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 1:09am UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/1 "2019-03-22T01:09:55Z")
hello,
I’m hosting discourse in digital ocean and added all the DNS records. The site is in [https://forum.jlozadad.io](https://forum.jlozadad.io). After adding the required changes to use letsencrypt and rebuild I get this error after the site completes rebuilding
```plaintext
2019/03/22 01:08:00 [emerg] 10927#10927: PEM_read_bio_X509_AUX("/shared/ssl/forum.jlozadad.io.cer") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE)
```
---
### Author:  [@robbyoconnor](https://meta.discourse.org/u/robbyoconnor)
#### Post date: [March 22, 2019, 1:55am UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/2 "2019-03-22T01:55:11Z")
This should be handled for you… you shouldn’t need to handle anything – the let’s encrypt cert is generated for you.
Uncomment [this line](https://github.com/discourse/discourse_docker/blob/master/samples/standalone.yml#L17) and you should be good to go.
---
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 2:02am UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/3 "2019-03-22T02:02:25Z")
so I have to change it in standalone.yml and not containers/app.yml ?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 22, 2019, 2:35am UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/4 "2019-03-22T02:35:24Z")
No, ignore that.
If you’re using the [standard install](https://meta.discourse.org/t/142537?silent=true) the letsencrypt and web.ssl templates need to be uncommented in your app.yml and you need to put your email address into the let’s encrypt email field.
Make sure the https port is exposed too:
---
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 2:52am UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/5 "2019-03-22T02:52:28Z")
yes that’s what I have in the configuration and it seems that it creates the certificates and everything but, when looking at the nginx error.log the error pasted above comes up.
```plaintext
templates:
- "templates/postgres.template.yml"
- "templates/redis.template.yml"
- "templates/web.template.yml"
- "templates/web.ratelimited.template.yml"
## Uncomment these two lines if you wish to add Lets Encrypt (https)
- "templates/web.ssl.template.yml"
- "templates/web.letsencrypt.ssl.template.yml"
expose:
- "80:80" # http
- "443:443" # https
LETSENCRYPT_ACCOUNT_EMAIL: 'myemail@gmail.com'
```
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [March 22, 2019, 12:47pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/6 "2019-03-22T12:47:15Z")
Do you have something like cloudflare in front of your server or does the domain resolve directly to the IP of your droplet?
Did you run discourse-setup to enable let’s encrypt or did you do it by hand (it looks OK at brief inspection)?
---
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 3:18pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/7 "2019-03-22T15:18:55Z")
nothing in front of like cloudflare
I uncommented the options in containers/app.yml as described before and then rebuild the cotainer. I have not used discourse-setup.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 22, 2019, 3:23pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/8 "2019-03-22T15:23:18Z")
What does DNS look like, does your server IP match the a record?
There’s no harm in running discourse setup, it will verify the basics. You can take a backup of your app.yml beforehand if you’re concerned.
---
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 3:36pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/9 "2019-03-22T15:36:07Z")
yes I have a A record that points to the drop/IP in digital ocean. so just run
`./discourse-setup` ?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [March 22, 2019, 3:45pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/10 "2019-03-22T15:45:20Z")
I doubt it’ll help. It likely won’t hurt, but it can get confused if you make edits that it doesn’t expect.
Rebuilding again is my best guess.
You could try removing the let’s encrypt and ssl directories so that they get recreated.
---
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 3:49pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/11 "2019-03-22T15:49:40Z")
ok, I’ll try discourse-setup but, yes I removed the lets encrypt and ssl directories a couple of times, rebuild and still ran into the error listed in the first post.
---
### Author:  [@chagara](https://meta.discourse.org/u/chagara)
#### Post date: [March 22, 2019, 5:04pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/12 "2019-03-22T17:04:49Z")
ok so using `discourse-setup` fixed it complete. I think the mistake was that I’m using Digital Ocean’s option to one click deploy discourse and used their scrips located in /var/lib/digitalocean to rebuild it. Also used the ./launcher rebuild app after making the changes and need to use discourse-setup. Thank you for all the help
!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [April 21, 2019, 5:05pm UTC](https://meta.discourse.org/t/using-letsencrypt-inside-discourse/112297/13 "2019-04-21T17:05:06Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.