SOLFIND
Web Lens		Portal home
Home  |  New Lens  |  About
Web address:

SSL, Certificate, and Reverse Proxy Errors | Appsmith

https://docs.appsmith.com/help-and-support/troubleshooting-guide/ssl-certificate-errors • 53 KB fetched
Open original page

SSL, Certificate, and Reverse Proxy Errors | Appsmith

Skip to main content

Ask AI
Search

Ask Appsmith AI Submit message

Examples How do I install Appsmith using Docker? How do I connect to my local PostgreSQL database? How do I pass inputs from a widget to a query? How do I trigger multiple queries conditionally? How do I fix the error: This value does not evaluate to type Array<Object>?

Search

Try Appsmith

* Get Started

* Introduction

* Build Your First App

* Self Hosting

* New Installation Guides

* Manage Installation

* Upgrade Installation Guides

* Concepts

* Connect Data

* Overview

* How-to Guides

* Reference

* Datasources

* Query Settings

* Concepts

* Build Apps

* Overview

* Quickstart

* How-to Guides

* Reference

* Widgets

* Accessibility

* Theme

* Sample Apps

* Write Code

* Overview

* How-to Guides

* Reference

* Global Objects

* Global Functions

* JS Libraries

* Fetch API

* Data Transformation

* JavaScript Settings

* Concepts

* Best Practices

* Manage Apps and Users

* Authentication

* Granular Access Control

* Versioning with Git

* Setup SCIM Provisioning

* Embed Appsmith

* Migrate Applications

* Audit Logs

* Branding

* External Client Portal

* Packages

* Overview

* Tutorial

* How-to Guides

* Reference

* Package Version Control

* GIT Apps with Packages Best Practices

* Code Packages

* UI Packages

* Workflows

* Overview

* Tutorial

* How-to Guides

* Reference

* Workflow Triggers

* Workflow Queries

* Workflow Functions

* Pass Parameters to Workflows

* Run History

* Troubleshooting

* Overview

* Self-hosting Errors

* MongoDB Startup Error Post Migration to Version 5

* Schema Mismatch Error

* Kubernetes Helm Chart 3.0.4 Upgrade Error

* Recover admin access when you don't know the admin email

* Backup and Restore Errors

* License and Activation Errors

* Verify connectivity to cs.appsmith.com

* SSO and Authentication Errors

* User Management and Permissions Errors

* SSL, Certificate, and Reverse Proxy Errors

* Email and SMTP Errors

* Performance and Resource Errors

* Monitoring and Audit Log Errors

* Upgrade and Migration Errors

* Application Errors

* Product

* FAQ

* Security

* Telemetry

* Support at Appsmith

* Privacy Policy

* Release Notes

* Contribute

© 2026 Appsmith, Inc.

*

* Troubleshooting

* Self-hosting Errors

* SSL, Certificate, and Reverse Proxy Errors
On this page
SSL, Certificate, and Reverse Proxy Errors

This page shows how to resolve common SSL, certificate, and reverse proxy errors on self-hosted Appsmith.

Custom CA or self-signed certificate not trusted ​

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Cause ​

Appsmith does not trust the certificate presented by an internal endpoint or by a firewall/proxy that performs SSL decryption. This happens when the signing CA root certificate is not in Appsmith's trust store.

Solution ​

* Add the custom CA root certificate to the ca-certs folder. For Docker, place it in stacks/ca-certs ; for Kubernetes add it via values.yaml . If the file has a .pem extension, rename it to .crt . See Custom CA Root Certificate .

* Add the correct issuing CA certificate, not the server's own self-signed certificate. You can extract the chain with openssl s_client -connect <host>:443 -showcerts and identify the issuing CA cert.

* Restart Appsmith after adding the certificate so it applies the change on startup.

* Verify the bundle works before relying on it: curl --cacert <bundle>.crt https://<your-appsmith-host> .

Self-signed certificate on a datasource or API action ​

Cause ​

A self-signed certificate used by a specific datasource or API endpoint is not a CA-signed certificate, so adding it to the ca-certs folder is not the intended fix and will not work.

Solution ​

* For a self-signed certificate, attach the certificate directly to the API action in the UI rather than placing it in ca-certs .

* Only use the ca-certs folder when the certificate is signed by a custom Certificate Authority (CA). In that case add the custom CA's certificate, not the leaf/self-signed certificate.

External MongoDB TLS connection fails ​

Client network socket disconnected before secure TLS connection was established

Cause ​

Appsmith cannot complete the TLS handshake with an external MongoDB. This typically occurs when the replica set is not initialized or the connecting user lacks the required roles, rather than a certificate problem in Appsmith itself.

Solution ​

* Run rs.initiate() as an admin user inside your MongoDB cluster to start the replica set configuration, which Appsmith requires for an external MongoDB.

* Ensure the user Appsmith connects with has the readWrite and clusterMonitor roles assigned.

* Test connectivity from a standalone instance in the same network to confirm MongoDB is reachable.

Certificate renewal not reflected when SSL terminates at a load balancer ​

Cause ​

When SSL termination happens at a load balancer, the application servers communicate over plain HTTP and never see or validate the external SSL certificate. Updating ca-certs on the application servers therefore has no effect on the public certificate.

Solution ​

* If SSL terminates at the load balancer, update the certificate there; there is no need to update ca-certs on the application servers.

* Only update ca-certs on the application servers if Appsmith makes outbound HTTPS calls to other services, if load-balancer-to-application traffic is encrypted, or if mutual TLS (mTLS) is in use.

Custom domain causes redirect loops or 401 errors behind a reverse proxy ​

Cause ​

When NGINX, ingress-nginx, or another load balancer sits in front of the Appsmith container and also handles SSL termination, setting APPSMITH_CUSTOM_DOMAIN conflicts with the proxy and causes bad redirects, infinite redirect loops, 401 errors, or NULL domain errors.

Solution ​

* If you have NGINX, ingress-nginx, or any load balancer in front of the Appsmith container, remove the APPSMITH_CUSTOM_DOMAIN environment variable from your docker.env / values to avoid bad redirects and 401 errors.

* Avoid using the latest image tag; pin a concrete version so multiple Appsmith versions don't run in the cluster simultaneously.

Setting up a custom domain with SSL ​

Cause ​

A custom domain with HTTPS is not reachable because prerequisites such as open ports are not met, or because custom domains are being attempted on Appsmith Cloud (not supported).

Solution ​

* Custom domains and SSL are only available on self-hosted Appsmith; this cannot be configured on Appsmith Cloud.

* Ensure ports 80 and 443 are open and accessible (or your custom ports if used). See Custom Domain and SSL .

* Appsmith can provision a certificate automatically through Let's Encrypt when the domain is set; access the instance via HTTPS on port 443 after restart.

Adding the HTTP Strict-Transport-Security (HSTS) header ​

Cause ​

Appsmith does not provide a built-in option to add the Strict-Transport-Security (HSTS) header to all responses.

Solution ​

* Adding the HSTS header to all Appsmith responses is not available directly in Appsmith. Configure it on your gateway/reverse proxy instead (for example, a header-setting policy on the API gateway in front of Appsmith).

Was this page helpful?

Edit this page

Previous
User Management and Permissions Errors
Next
Email and SMTP Errors

* Custom CA or self-signed certificate not trusted

* Self-signed certificate on a datasource or API action

* External MongoDB TLS connection fails

* Certificate renewal not reflected when SSL terminates at a load balancer

* Custom domain causes redirect loops or 401 errors behind a reverse proxy

* Setting up a custom domain with SSL

* Adding the HTTP Strict-Transport-Security (HSTS) header

Links found on this page

  1. Skip to main content [direct]
  2. Try Appsmith [direct]
  3. Get Started [direct]
  4. Build Your First App [direct]
  5. Self Hosting [direct]
  6. New Installation Guides [direct]
  7. Manage Installation [direct]
  8. Upgrade Installation Guides [direct]
  9. Concepts [direct]
  10. Connect Data [direct]
  11. How-to Guides [direct]
  12. Reference [direct]
  13. Query Settings [direct]
  14. Concepts [direct]
  15. Build Apps [direct]
  16. Quickstart [direct]
  17. How-to Guides [direct]
  18. Reference [direct]
  19. Widgets [direct]
  20. Accessibility [direct]
  21. Theme [direct]
  22. Sample Apps [direct]
  23. Write Code [direct]
  24. How-to Guides [direct]
  25. Reference [direct]
  26. Global Objects [direct]
  27. Global Functions [direct]
  28. JS Libraries [direct]
  29. Fetch API [direct]
  30. Data Transformation [direct]
  31. JavaScript Settings [direct]
  32. Concepts [direct]
  33. Best Practices [direct]
  34. Manage Apps and Users [direct]
  35. Granular Access Control [direct]
  36. Versioning with Git [direct]
  37. Setup SCIM Provisioning [direct]
  38. Embed Appsmith [direct]
  39. Migrate Applications [direct]
  40. Audit Logs [direct]
  41. Branding [direct]
  42. External Client Portal [direct]
  43. Packages [direct]
  44. Tutorial [direct]
  45. How-to Guides [direct]
  46. Reference [direct]
  47. GIT Apps with Packages Best Practices [direct]
  48. Code Packages [direct]
  49. UI Packages [direct]
  50. Workflows [direct]
  51. Tutorial [direct]
  52. How-to Guides [direct]
  53. Reference [direct]
  54. Workflow Queries [direct]
  55. Workflow Functions [direct]
  56. Pass Parameters to Workflows [direct]
  57. Run History [direct]
  58. Troubleshooting [direct]
  59. Self-hosting Errors [direct]
  60. MongoDB Startup Error Post Migration to Version 5 [direct]
  61. Schema Mismatch Error [direct]
  62. Kubernetes Helm Chart 3.0.4 Upgrade Error [direct]
  63. Recover admin access when you don't know the admin email [direct]
  64. Backup and Restore Errors [direct]
  65. License and Activation Errors [direct]
  66. Verify connectivity to cs.appsmith.com [direct]
  67. SSO and Authentication Errors [direct]
  68. User Management and Permissions Errors [direct]
  69. Email and SMTP Errors [direct]
  70. Performance and Resource Errors [direct]
  71. Monitoring and Audit Log Errors [direct]
  72. Upgrade and Migration Errors [direct]
  73. Application Errors [direct]
  74. Product [direct]
  75. Security [direct]
  76. Telemetry [direct]
  77. Support at Appsmith [direct]
  78. Privacy Policy [direct]
  79. Release Notes [direct]
  80. Contribute [direct]
SolFind Lens does not relay logins, forms, files, images, audio, or video.Portal home
With content from Curlie.org - the largest human-edited directory of the web. Contribute by submitting a website or becoming an editor.