Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need some advice.

We have an e-commerce website hosted at HostGator. Yesterday I ordered a RapidSSL certificate and they auto-configured it for me which made https://www.ourdomain.com work fine. I thought everything was going well and continued over night to push the application live and work on some tests with the payment gateway.

This morning I found out that people were having issues accessing the site, although it worked fine for me. It appeared that adding the SSL certificate invalidated the DNS and it had to re-propagate. HostGator did mention that they would be giving us a dedicated IP address along with the certificate.

Using http://www.startping.com to try to ping the domain from various places around the world, I'm seeing that only half or so point to the correct IP. The rest are pointing to some random IP that we weren't even using in the first place.

TLDR: I added an SSL certificate to our website and now the site is unavailable to several places around the world. Is this a DNS propagation issue or some other "gotcha" I'm not aware of?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

This is normal - they should have warned you though - and you should expect interruptions for at least the next day (if you're lucky; and the next month if you're unlucky).

Older versions of SSL require their own IP. SNI is a "modern" technology that lets multiple sites share an IP, in the same way that standard HTTP can share via Virtual Hosts. SNI has about 80% support however, and 20% is enough to guarantee that no major hosting site will support it. So when you implement SSL, you require your own IP address (you're probably paying more for this too).

Since you're switching IP addresses, it will take time for anyone who has the old IP cached to grab the new IP. Your TTL is 4 hours, so anyone who hasn't visited your site in the last 4 hours should be working now. Some DNS servers don't play by the rules (and it's too hard to identify them to do anything about it - as much as I'd really like to) and will cache your entry as long as they'd like (which could mean malfunctioning patrons for some time to come).

This is all very common among the hosting industry, though my host gave a huge red warning about interruptions and stuff (they went out of their way to explain the issues, very likely they got tired of having to explain it to people who didn't know already). I'd like to be surprised that your hosting provider didn't, but in honest they're probably charging <$5 a month for basic hosting packages (SSL, Domain name, IP, etc all extra) and are betting they wont piss you off enough to make you leave.

share|improve this answer
    
So it is DNS related? –  cillosis Apr 30 '13 at 18:38
    
Could you expand on your answer? I'm genuinely intrigued as I've never had DNS issues when buying an SSL cert and I'd certainly like to avoid it in the future. How does buying an SSL cert affect your DNS namespace if they have no control over it? –  Chris McKeown Apr 30 '13 at 18:38
    
HostGator did mention that they would be giving us a dedicated IP address along with the certificate. did it. They used to have DNS for your server www.doodlesculpt.com pointing to one of their shared servers. When you ordered an SSL certificate, they had to give you a unique not-shared IP address, and change your DNS to point to it, so DNS caching servers round the world are returning the old one until their cache expires (24-48 hours tops, usually). Except some random IP that we weren't even using in the first place. - how sure of that are you? –  TessellatingHeckler Apr 30 '13 at 18:52
    
IMHO, if hostgator provide your DNS and hosting then switched off the shared vhost before the TTL of your DNS records then its a big error on their part - this is such a simple thing to get wrong! –  symcbean Apr 30 '13 at 22:00
    
@symcbean Eh, you get what you pay for, and HostGator is constantly on the the "10 Cheapest Hosts" lists. As I mentioned, they aren't trying to give you good service, just not so bad that you leave... –  Chris S May 1 '13 at 12:47

While the other answers deal with the change from a shared IP to a dedicated IP to support SSL, there is one thing that was missed.

You have four nameservers for your domain:

    NS1541.HOSTGATOR.COM
    NS1542.HOSTGATOR.COM
    NS3.MONIKERDNS.NET         207.189.109.118
    NS4.MONIKERDNS.NET         63.149.176.26

The IP address returned by the HOSTGATOR.COM servers does not agree with the address returned by MONIKERDNS.NET, until this is fixed people are going to randomly get sent to the wrong place.

share|improve this answer
    
Ahhh, there's that "random" IP address. Thanks for pointing that out! That's going to save me a lot of headaches. –  cillosis Apr 30 '13 at 19:49

Yes, this is normal.

With HTTP you send a HTTP (not HTTPS) GET header, where you say which page you want, and also from which domain you want it. Sending the domain in the header, makes it posible to serve data for several domain on one webserver.

With HTTPS you first have to verify the certificate, and then send the request, so the webserver has no idea which domain are you trying to access when you initiate the handshake, so it is possible to have only one domain (one certificate) on one webserver* (*this is fixed with SNI, which is sadly still not supported on some browsers, eg. IE6, android browser on 2.x versions, etc.)

So, for your HTTPS webpage to work on all browsers, it has to be on a separate IP (no other https pages can use it), so your DNS entries have to point to that new IP.

Depending on your TTL setting, it takes some time to redistribute your IP address change.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.