Nhost local cert errors can be your own nginx on port 443

TL;DR

For "Nhost local cert errors can be your own nginx on port 443": use openssl s_client to inspect the presented certificate's issuer and expiry; a stale Let's Encrypt cert that does not match Nhost's current one points at a port conflict. In agent-run dev environments, always scan for processes on 443/80 before starting local stacks.

Nhost local cert errors can be your own nginx on port 443

When to use

You are seeing this: If nhost up reports an expired or invalid certificate for local subdomains, check what is actually listening on port 443 before blaming Nhost: another server on the machine can serve its own certificate for those hostnames. Use this skill when you run into "Nhost local cert errors can be your own nginx on port 443".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Steps

1. If nhost up reports an expired or invalid certificate for local subdomains, check what is actually listening on port 443 before blaming Nhost: another server on the machine can serve its own certificate for those hostnames. Use openssl s_client to inspect the presented certificate's issuer and expiry; a stale Let's Encrypt cert that does not match Nhost's current one points at a port conflict. Stop the conflicting service and retry. In agent-run dev environments, always scan for processes on 443/80 before starting local stacks.

Source: GitHub issue nhost/nhost#3842 (closed, 4 comments): nhost up failed with x509 certificate has expired or is not yet valid on local.nhost.run subdomains, and curl verification failed with unable to get local issuer certificate. The maintainer could not reproduce it and asked for the served certificate details; the reporter then discovered their own system had a running nginx instance bound to port 443 serving a stale certificate, which intercepted all the local Nhost traffic. Stopping nginx and reinstalling resolved it.

Verified resolution: If nhost up reports an expired or invalid certificate for local subdomains, check what is actually listening on port 443 before blaming Nhost: another server on the machine can serve its own certificate for those hostnames. Use openssl s_client to inspect the presented certificate's issuer and expiry; a stale Let's Encrypt cert that does not match Nhost's current one points at a port conflict. Stop the conflicting service and retry. In agent-run dev environments, always scan for processes on 443/80 before starting local stacks.

Source URL: https://github.com/nhost/nhost/issues/3842