Did just finish. Worked totally fine for me without changes. Created the LetsEncrypt certificate without a problem.
Wonder why it is different for you and why you need those changes for it to work.
According to LetsEncrypt, it’s sometimes required, sometimes not.
Looking at the docker a bit more… I see Trafeik is using LetsEncrypt’s TLS-ALPN-1 challenge which doesn’t require port 80.
So the reporting I gave earlier was based on the assumption it was using HTTP-01
it is performed via TLS on port 443
This should be fine given the Traefik config.
However, it uses a custom ALPN protocol to ensure that only servers that are aware of this challenge type will respond to validation requests.
Ah I wonder if this could be it? Does my server cover this? Digital Ocean + Debian. What is weird is that having fixed port 80, but still using tlsChallenge, fixed the problem. So what’s going on there, I can’t say.
This challenge is not suitable for most people. It is best suited to authors of TLS-terminating reverse proxies that want to perform host-based validation like HTTP-01, but want to do it entirely at the TLS layer in order to separate concerns. Right now that mainly means large hosting providers, but mainstream web servers like Apache and Nginx could someday implement this (and Caddy already does).
Hmm.
I’ll keep looking at this but it seems it might only be marginally relevant to n8n, only insofar as it helps people get it installed without a hitch.
Unrelated find:
Our recommendation is that all servers meant for general web use should offer both HTTP on port 80 and HTTPS on port 443. They should also send redirects for all port 80 requests, and possibly an HSTS header (on port 443 requests)
Allowing port 80 doesn’t introduce a larger attack surface on your server, because requests on port 80 are generally served by the same software that runs on port 443.
Hi @jan,@janbaykara,
Interesting, I installed n8n in DigitalOcean and no issues, but when installing in Vultr, I also have the same SSL issue with port80.
Thank you so much for sharing all of this! I believe I am having the same problem. Did you find any solutions other than the port 80 work-around?
I have n8n running in docker and reverse-proxied with Caddy. Makes things really easy as it automatically handles provisioning SSL.
Did I mention that the reverse proxy configuration is only a single line? 
That’s excellent! I’m super new to servers and everything so I’m learning as I go. I’m definitely researching Caddy and reverse proxy configuration now! Would you mind sharing any details that might make it easier for me to setup? Thanks for sharing!
Do you want to share your docker/caddy config?
Here you go @rubymel! Put both of those files in the same folder, and you should be able to do docker-compose up
Let me know if you have any questions!
docker-compose.yml
Using host networking mode as I have n8n (and other services) hosted on a different LAN host than the one running the caddy docker container
services:
caddy:
image: caddy
container_name: caddy
restart: always
ports:
- 80:80
- 443:443
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
network_mode: "host"
Caddyfile
n8n.yourdomain.com {
reverse_proxy http://your-n8n-host:port
header {
Strict-Transport-Security "max-age=31536000;"
X-XSS-Protection "1; mode=block"
X-Frame-Options "DENY"
X-Robots-Tag "none"
-Server
}
}
I agree that it is best practice for a public website to have a redirect from port 80 to 443 but do not really see it for something like n8n. I would say the less visibility the better.
I think this is fine if you’re going to just use it yourself, but in my case I’m working with people less technical people - telling them to add https:// before the url makes them confused as to why it doesn’t just work like everything else
Thanks the Caddy worked perfectly.
I will post my full config in case someone wants to see a working config, using caddy and n8n on the same host, with a postgresDB (feel free to change the config to suite your needs.
version: '3.1'
services:
caddy:
image: caddy
container_name: caddy
restart: always
ports:
- 80:80
- 443:443
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
n8n:
image: n8nio/n8n
restart: always
environment:
- DB_TYPE=postgresdb
- DB_POSTGRESDB_HOST=POSTGRES_HOST_IP
- DB_POSTGRESDB_PORT=5432
- DB_POSTGRESDB_DATABASE=${POSTGRES_DB}
- DB_POSTGRESDB_USER=${POSTGRES_NON_ROOT_USER}
- DB_POSTGRESDB_PASSWORD=${POSTGRES_NON_ROOT_PASSWORD}
- N8N_BASIC_AUTH_ACTIVE=true
- N8N_BASIC_AUTH_USER
- N8N_BASIC_AUTH_PASSWORD
- N8N_EMAIL_MODE
- N8N_SMTP_HOST
- N8N_SMTP_PORT
- N8N_SMTP_USER
- N8N_SMTP_PASS
- N8N_SMTP_SENDER
- N8N_SMTP_SSL
- WEBHOOK_URL=$N8N_PROTOCOL://My_Host_Name:$N8N_PORT
- N8N_EDITOR_BASE_URL=$N8N_PROTOCOL:/My_Host_Name:$N8N_PORT
ports:
- 5678:5678
volumes:
- ~/.n8n:/home/n8n/.n8n
# Wait 5 seconds to start n8n to make sure that PostgreSQL is ready
# when n8n tries to connect to it
command: /bin/sh -c "sleep 5; n8n start"
Just run this command in your server and reboot
sudo apt-get install apt-transport-https ca-certificates curl curl software-properties-common
PS: to check whether it’s working or not open your domain link or IP in incognito mode,
If there is anyone from n8n reading this actually I found this command being included in docs itself(in an old tutorial from youtube) recent docs at the time of writing does not have this command please include this too 
Hey @chirun8n,
Welcome to the community 
This is a really old post that I am going to lock but looking at your command it will just install packages that may already exist into a debian based OS and it won’t actually set up an SSL certificate that can be used with n8n.