> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/aws/dns-setup-aws/troubleshooting.md).
# Troubleshooting
DNS Setup (AWS)
### Issue 1: Certificate Not Issued / ACME Errors
**Symptom:** Caddy logs show ACME/certificate errors, or the HTTPS URL shows an untrusted certificate instead of a trusted one.
**Likely causes:**
* DNS hasn't fully propagated yet
* Port 80 is blocked by the security group (needed for Let's Encrypt validation)
* The DNS A record points to the wrong IP
**Diagnostics (run on the VM):**
Replace `hivel.yourcompany.com` with your actual domain.
```
# Confirm DNS resolves to VM's IP
dig +short hivel.yourcompany.com
# Confirm port 80 is reachable from the internet
curl -I http://hivel.yourcompany.com
# Check Caddy's logs for the specific ACME error
docker logs caddy --tail 100
```
**Resolution:**
1. **If `dig` doesn't return your VM's IP:** Wait for DNS propagation (typically 5–15 minutes). Re-run `dig +short` to confirm.
2. **If `curl` times out:** Port 80 is blocked. In AWS Console:
* Go to EC2 > Security Groups > Your VM's security group
* Add an inbound rule: Custom TCP, port 80, source 0.0.0.0/0
* Wait \~1 minute and restart Caddy: `docker restart caddy`
3. **If both work but Caddy still shows errors:** Check your A record points to the correct VM IP in AWS Route53.
**How to verify the fix:**
```
docker logs -f caddy
```
Wait for a line confirming `certificate obtained successfully`, then open your HTTPS URL in a browser. It should show a trusted certificate.
**For support:** Provide `docker logs caddy --tail 100`, output of `dig +short`, and output of `curl -I http://hivel.yourcompany.com`.
### Issue 2: Connection Refused on Port 443
**Symptom:** Navigating to the HTTPS URL fails immediately with "connection refused" or times out.
**Likely causes:**
* Caddy container isn't running
* Port 443 isn't open in the VM's security group
**Diagnostics (run on the VM):**
```
# Check if Caddy container is running
docker ps | grep caddy
```
Then verify port 443 is open in AWS Console:
* Go to EC2 > Security Groups > Your VM's security group
* Look for an inbound rule on port 443
**Resolution:**
1. **If Caddy isn't running:** Start it:
```
docker start caddy
```
2. **If port 443 isn't open:** In AWS Console, add an inbound rule:
* Type: Custom TCP
* Port: 443
* Source: 0.0.0.0/0 (or your office/VPN CIDR)
**How to verify the fix:** Navigate to your HTTPS URL. It should connect and load.
**For support:** Provide output of `docker ps -a | grep caddy` and a screenshot of your security group's inbound rules.
### Issue 3: HTTPS Loads but Shows Blank Page or 502 Error
**Symptom:** The HTTPS URL connects and loads, but the page is blank or shows a 502 error.
**Likely cause:** The Hivel UI container itself isn't healthy - this is a deployment issue unrelated to Caddy.
**Diagnostics (run on the VM):**
```
# Check if the UI container is running
docker ps | grep insightly-ui
# Test if the UI is reachable directly on port 3000
curl -I http://localhost:3000
```
**Resolution:**
The issue is with the UI container, not Caddy. Fixing Caddy's configuration won't help until the UI itself is healthy.
1. Check the UI container's logs:
```
docker logs insightly-ui
```
2. If the UI isn't running or is failing, refer to Troubleshooting in the main deployment guide for help with the deployment itself.
**How to verify the fix:**
```
curl -I http://localhost:3000
```
Should return a healthy response (HTTP 200). Then reload your HTTPS URL - it should load correctly.
**For support:** Provide `docker logs insightly-ui` and the output of `curl -I http://localhost:3000`.
{% columns %}
{% column %} Back to Managing the Caddy Container
{% endcolumn %}
{% column %}
{% endcolumn %}
{% column %} Quick Reference
{% endcolumn %}
{% endcolumns %}