CODEWITHSUNDEEP
apachesslcpanelhttp2
Jon Erickson
Jon Erickson

Reputation: 1976

Misdirected redirect with 3 domains on EV SSL

Error:

The client needs a new connection for this request as the requested host name does not match the Server Name Indication (SNI) in use for this connection.

I recently purchased a EV SSL certificate from Comodo, installed it on my VPS (cPanel/WHM) and everything worked great. I then upgraded to http2 and am now receiving the error when switching between each website on the certificate. The 3 websites share the same IP address. From what I can tell, this may be the issue. I do not want to reissue a SSL cert for each domain as I paid for the EV multi domain cert. Is the answer to purchase 2 additional IPs and make sure each domain has its own IP? Or is there a way I can edit the virtual hosts so that I can maintain the same setup I have now?

I should mention, this is only happening on Safari, not chrome.

SSL Labs Report

https://www.ssllabs.com/ssltest/analyze.html?d=www.deschutesdesigngroup.com&s=142.4.0.142&hideResults=on

EasyApache HTTP vhost configuration

https://pastebin.com/dNeFRGWJ

EasyApache HTTPS vhost configuration

https://pastebin.com/vgWAD5mg

Upvotes: 0

Views: 1144

Answers (1)

Barry Pollard
Barry Pollard

Reputation: 46040

You have enabled HTTP/2 on only two of the three sites.

HTTP/2 will try to reuse the connection for multiple domains if both the IP address matches and the certificate covers all the necessary domains. This is the case here and so HTTP/2 is reused.

However if you run SSLLabs on all three domains you see a slight difference in the protocol used for Chrome (for example):

Chrome 70 / Win 10  RSA 2048 (SHA256)   TLS 1.2 > h2  
Chrome 70 / Win 10  RSA 2048 (SHA256)   TLS 1.2 > http/1.1  
Chrome 70 / Win 10  RSA 2048 (SHA256)   TLS 1.2 > h2

And similarly further down in the ALPN setting:

ALPN    Yes   h2 http/1.1
ALPN    Yes   http/1.1
ALPN    Yes   h2 http/1.1

So going to the middle domain first will work as it will connect via HTTP/1.1 and so not reuse the connection. However going to the middle domain after initiating a request to either the first or last domain will attempt to reuse the HTTP/2 connection and fail as the middle domain doesn't support HTTP/2.

Web servers should return a 421 Misdirected Request status code for any requests when the browser attempts to reuse the connection when it shouldn't, to say "Yeah you really shouldn't be attempting to reuse the connection here! Can you try again on another connection please?". The same thing happens if there are different SSL/TLS setup (e.g. the cipher suite used for the connection is not accepted on the other domain).

Chrome and Firefox correctly handle the 421 response and transparently resend the requests over a new connection, which in this case then uses HTTP/1.1 (check out developer tools in the browser and you'll see this is true). Other browsers, including Safari used by iOS, have not implemented support of the relatively new 421 status code yet and so fail with an error like below:

Misdirected Request

The client needs a new connection for this request as the requested host name does not match the Server Name Indication (SNI) in use for this connection.

I presume there is no reason not to enable HTTP/2 on all domains and this was a misconfiguration error? If so enable HTTP/2 in all domains and your issue should be sorted.

If you do not want HTTP/2 on all domains, then you ensure the browser doesn't think it can reuse the connection. That means either using a separate IP address for that domain, or getting the certificate reissued for only two domains, and a separate certificate for the other than shouldn't share connections.

Upvotes: 1

Related Questions