[Bug]: No available server when Cloudflare SSL/TLS policy is set to Full, with multiple domains

[clho40]

Error Message and Logs

When deploying a WordPress application with MariaDB on a Coolify instance hosted on a VPS, using a Cloudflare-managed domain (def.com), browsing with SSL set to "Flexible" results in mixed content issues, while setting SSL to "Full" produces a "No available server" error.

Steps to Reproduce

1. Set up a VPS with Coolify.
2. Point two Cloudflare-managed domains (abc.com and def.com) to the VPS IP using A records.
3. Configure the Coolify instance to use http://coolify.abc.com as its domain name.
4. Create a new WordPress with MariaDB application on Coolify.
5. Assign def.com as the domain name for the WordPress resource.
6. Set Cloudflare SSL mode for def.com to "Flexible" and browse the site.
7. Observed result: The site loads, but some scripts are served over HTTP, causing mixed content issues.
8. Change Cloudflare SSL mode for def.com to "Full" and browse the site.
9. Observed result: "No available server" error.

Example Repository URL

No response

Coolify Version

v4.0.0-beta.380

Are you using Coolify Cloud?

No (self-hosted)

Operating System and Version (self-hosted)

Ubuntu 24

Additional Information

No response

[clho40]

New findings, I follow this guide: https://coolify.io/docs/knowledge-base/traefik/custom-ssl-certs

I have generated the .pem and .key files from Cloudflare, uploaded them to /data/coolify/proxy/certs as

• somedomain.pem
• somedomain.key

and in /data/coolify/proxy/dynamic, I have created a new file tls.yaml and added the following config:

tls:
  certificates:
    - certFile: "/data/coolify/proxy/certs/somedomain.pem"
      keyFile: "/data/coolify/proxy/certs/somedomain.key"

and I get the following error:

ERR Unable to append certificate /data/coolify/proxy/certs/somedomain.pem to store error="unable to generate TLS certificate : tls: failed to find any PEM data in certificate input" tlsStoreName=default

I have also tried renaming the extension .pem to .cert, and I get the same error. I can confirm that the file has -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----

[djsisson]

@clho40

1. for some apps you need to set the domain to be https, if it cant be overridden inside the app, otherwise it passes back http links to content, hence the mixed content error

2. if you are behind a dns proxy, you can use full, with https in your domains, it just means cf won't check your server cert (which will be the default traefik cert, since http challenges fail for domains behind a dns proxy), using flexible just means it will only send requests as http which brings you back to point 1

3. traefik is using a volume mount so if your certs are at that location, then in the dynamic file they need to be at /traefik/certs/somedomain.key inorder for it to pick them up, then its ok to switch to full(strict)

[clho40]

Hello, I think point #3

@clho40

1. for some apps you need to set the domain to be https, if it cant be overridden inside the app, otherwise it passes back http links to content, hence the mixed content error
2. if you are behind a dns proxy, you can use full, with https in your domains, it just means cf won't check your server cert (which will be the default traefik cert, since http challenges fail for domains behind a dns proxy), using flexible just means it will only send requests as http which brings you back to point 1
3. traefik is using a volume mount so if your certs are at that location, then in the dynamic file they need to be at /traefik/certs/somedomain.key inorder for it to pick them up, then its ok to switch to full(strict)

Hello, I think point 3 solved the issue. After changing the dynamic configuration to /traefik/certs/somedomain.key I don't get any error from the coolify-proxy container. However, I am still getting the error no available server when browsing the application with Full (Strict) SSL policy on Cloudflare. What could be the reason?

[djsisson]

@clho40 is your domain url set to https in your project?

[ninode97]

Having same problem.

Is there any way to handle it without:

3. traefik is using a volume mount so if your certs are at that location, then in the dynamic file they need to be at /traefik/certs/somedomain.key inorder for it to pick them up, then its ok to switch to full(strict)

I am using Cloudflare and Coolify Remote server.
And caddy as reverse proxy.

If I host the application it works on localhost
But if I try to create resource it runs into an error "SSL handshake failed ".

Am I missing something, do I need this "Cloudflare" tunnels feature ?

Any help would be be appreciated

[MrLesk]

if you go full SSL including the origin certificates the service port has to be 443 like below. This is not documented properly

[clho40]

@clho40 is your domain url set to https in your project?

Hi, that was the fix. Because I've been using the Flexible SSL policy on Cloudflare, I had to set my coolify domain name to http to avoid being redirected too many times. After setting it to Full (Strict) I had to set the instance domain to https.

Thanks!

[Dercont]

@clho40 How you were able to solve the issue with two domains set (abc.com, abc.es) on the same coolify instance?
I'm still getting the "not available server" error. And both domains are being managed by CF and set to Full Strict.

[oribenez]

@clho40 How you were able to solve the issue with two domains set (abc.com, abc.es) on the same coolify instance? I'm still getting the "not available server" error. And both domains are being managed by CF and set to Full Strict.

Same here
I get the "no available server" error for couple of full page refreshes and then the server is working for a second and then again...
this is like a ping pong for my services, some work and some not every couple of seconds.
If I look at the logs in coolify I see that all containers are up and running so the issue is or with the Certificates or with the proxy.

My setup
Proxy: traefik
Running Cloudflared predefined container by coolify with the appropriate token.

DNS is set to Full(Strict)
DNS name is: CNAME, with "*" and targets to: <tunnel-id>.cfargotunnel.com
certs added to the folder /data/coolify/proxy
changed all resources to https://

Also I've been following the tutorial: https://coolify.io/docs/knowledge-base/cloudflare/tunnels/all-resource
and right after I've followed this: https://coolify.io/docs/knowledge-base/cloudflare/tunnels/full-tls

[djsisson]

@oribenez

What kind of deployment is giving you an issue?

If this is a compose based deployment make sure you do not define a network in the compose

[oribenez]

It’s only Dockerfile by private git repo

…

On Sat, 15 Mar 2025 at 7:44 Darren Sisson ***@***.***> wrote: @oribenez <https://github.com/oribenez> What kind of deployment is giving you an issue? If this is a compose based deployment make sure you do not define a network in the compose — Reply to this email directly, view it on GitHub <#4804 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADSVJ7UVIBDAICOMJRVA5U32UO44TAVCNFSM6AAAAABU77GKVCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOMRWGI2DMMJQGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***> [image: djsisson]*djsisson* left a comment (coollabsio/coolify#4804) <#4804 (comment)> @oribenez <https://github.com/oribenez> What kind of deployment is giving you an issue? If this is a compose based deployment make sure you do not define a network in the compose — Reply to this email directly, view it on GitHub <#4804 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADSVJ7UVIBDAICOMJRVA5U32UO44TAVCNFSM6AAAAABU77GKVCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOMRWGI2DMMJQGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>