# Why is the Apple Touch Icon loaded via HTTP instead of HTTPS?
**URL:** https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501
**Category:** Support
**Created:** [December 17, 2018, 9:53pm UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501 "2018-12-17T21:53:15Z")
**Posts on this page:** 10
**Page:** 2
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 18, 2018, 3:16am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/21 "2018-12-18T03:16:05Z")
> [@brahn](#):
>
> Your symptoms are implying that firefox is being case sensitive where Chrome is not. If you add a WWW version to the let’s encrypt domain list does that make Firefox happy?
Worth a shot, thanks!
---
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 18, 2018, 3:28am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/22 "2018-12-18T03:28:50Z")
> [@brahn](#):
>
> Your symptoms are implying that firefox is being case sensitive where Chrome is not. If you add a WWW version to the let’s encrypt domain list does that make Firefox happy?
I’ve added `-d WWW.community.example.com` but `https://www.community.example.com` still doesn’t redirect in FF.
This is what I get in FF:
`SSL_ERROR_BAD_CERT_DOMAIN`
`www.community.example.com uses an invalid security certificate.`
`The certificate is only valid for community.example.com.`
`Unable to communicate securely with peer: requested domain name does not match the server’s certificate. `
`HTTP Strict Transport Security: false HTTP Public Key Pinning: false`
---
### Author:  [@brahn](https://meta.discourse.org/u/brahn)
#### Post date: [December 18, 2018, 3:57am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/23 "2018-12-18T03:57:03Z")
> [@Graphiwiz](#):
>
> The certificate is only valid for [community.example.com](http://community.example.com)
The certificate should list all the domains you have included, can you see them? Perhaps the certificate is not being recreated with the list of domains when you rebuild? Follow the debugging instructions in [Setting up HTTPS support with Let’s Encrypt](https://meta.discourse.org/t/setting-up-https-support-with-lets-encrypt/40709)
---
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 18, 2018, 4:13am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/24 "2018-12-18T04:13:51Z")
> [@brahn](#):
>
> The certificate should list all the domains you have included, can you see them? Perhaps the certificate is not being recreated with the list of domains when you rebuild? Follow the debugging instructions in [Setting up HTTPS support with Let’s Encrypt](https://meta.discourse.org/t/setting-up-https-support-with-lets-encrypt/40709)
**1.** For `./launcher logs app` I can see:
`www.example.com:Verify error:DNS problem: NXDOMAIN looking up A for www.example.com`
(that’s for the root, not for the discourse install, which is under `www.community.example.com`)
And also:
`Reload error for : Started runsvdir, PID is 326`
`ssyslogd: command 'KLogPermitNonKernelFacility' is currently not permitted`
`Domains not changed.`
`Add '--force' to force to renew.`
`Installing key to:/shared/ssl/comunity.example.com.key`
`Run reload cmd: sv reload nginx`
**2.** For ls `-l /var/discourse/shared/standalone/ssl` I get:
`total 8`
`-rw-r--r-- 1 ubuntu root 3924 Dec 18 03:56 community.example.com.cer`
`-rw------- 1 ubuntu root 3247 Dec 18 04:24 community.example.com.key`
Should I try and manually reissue the cert following instructions here [Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/setting-up-https-support-with-lets-encrypt/40709)?
---
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 18, 2018, 5:48am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/25 "2018-12-18T05:48:58Z")
Hours later.. tried pretty much everything and I still can’t get it to work.
In case I do have a breakthrough, I will update thread for future reference.
---
### Author:  [@brahn](https://meta.discourse.org/u/brahn)
#### Post date: [December 18, 2018, 10:25am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/26 "2018-12-18T10:25:41Z")
> [@Graphiwiz](#):
>
> `-rw-r--r-- 1 ubuntu root 3924 Dec 18 03:56 community.example.com.cer`
> `-rw------- 1 ubuntu root 3247 Dec 18 04:24 community.example.com.key`
Yes, you should be expecting to get one certificate containing multiple entries in the Subject Alternative Name field.
From [Setting up HTTPS support with Let’s Encrypt](https://meta.discourse.org/t/setting-up-https-support-with-lets-encrypt/40709):
> [@Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/set-up-https-support-with-lets-encrypt/40709/1):
>
> #### Delete the old cert files and try rebuilding again
>
> ```plaintext
> rm -rf /var/discourse/shared/standalone/ssl
> rm -rf /var/discourse/shared/standalone/letsencrypt
> ./launcher rebuild app
>
> ```
If you delete those two directories before rebuilding the container you can be sure that it will get fresh certificates when you rebuild.
---
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 18, 2018, 9:43pm UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/29 "2018-12-18T21:43:16Z")
> [@brahn](#):
>
> If you delete those two directories before rebuilding the container you can be sure that it will get fresh certificates when you rebuild.
Thanks! Yes, I always removed the old cert files before rebuilding with no success.
Just woke up now so I’m ready for another 12 hours of research, until I get to the bottom of this. I am starting everything from scratch on a new Lightsail instance.
Will update on the first bump.
---
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 19, 2018, 1:24am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/30 "2018-12-19T01:24:15Z")
**UPDATE** : I managed to make the www version on FF secure as well. All I did was remove the root domain (the one without the forum install) from the list: `-d example.com -d www.example.com` and all I have left is the actual forum `-d community.example.com -d www.community.example.com`. Not sure why that helped to be honest.
**NEW ISSUE** : Now I’ve got two different websites: the www doesn’t redirect to the non-www version like it did before for whatever reason.
---
### Author:  [@Graphiwiz](https://meta.discourse.org/u/Graphiwiz)
#### Post date: [December 19, 2018, 1:46am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/31 "2018-12-19T01:46:40Z")
> [@Graphiwiz](#):
>
> **NEW ISSUE** : Now I’ve got two different websites: the www doesn’t redirect to the non-www version like it did before for whatever reason.
Fixed by adding this 301 redirect to my `app.yml` hooks section:
```
- file:
path: /etc/nginx/conf.d/discourse_redirect_1.conf
contents: |
server {
listen 443;
server_name www.community.example.com;
return 301 $scheme://community.example.com$request_uri;
}
```
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [January 18, 2019, 1:48am UTC](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501/32 "2019-01-18T01:48:20Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
[Previous page](https://meta.discourse.org/t/why-is-the-apple-touch-icon-loaded-via-http-instead-of-https/104501.md?page=1)