I need some advice.

We have an e-commerce website hosted at HostGator. Yesterday I ordered a RapidSSL certificate and they auto-configured it for me which made https://www.ourdomain.com work fine. I thought everything was going well and continued over night to push the application live and work on some tests with the payment gateway.

This morning I found out that people were having issues accessing the site, although it worked fine for me. It appeared that adding the SSL certificate invalidated the DNS and it had to re-propagate. HostGator did mention that they would be giving us a dedicated IP address along with the certificate.

Using http://www.startping.com to try to ping the domain from various places around the world, I'm seeing that only half or so point to the correct IP. The rest are pointing to some random IP that we weren't even using in the first place.

TLDR: I added an SSL certificate to our website and now the site is unavailable to several places around the world. Is this a DNS propagation issue or some other "gotcha" I'm not aware of?

3 Answers 3


This is normal - they should have warned you though - and you should expect interruptions for at least the next day (if you're lucky; and the next month if you're unlucky).

Older versions of SSL require their own IP. SNI is a "modern" technology that lets multiple sites share an IP, in the same way that standard HTTP can share via Virtual Hosts. SNI has about 80% support however, and 20% is enough to guarantee that no major hosting site will support it. So when you implement SSL, you require your own IP address (you're probably paying more for this too).

Since you're switching IP addresses, it will take time for anyone who has the old IP cached to grab the new IP. Your TTL is 4 hours, so anyone who hasn't visited your site in the last 4 hours should be working now. Some DNS servers don't play by the rules (and it's too hard to identify them to do anything about it - as much as I'd really like to) and will cache your entry as long as they'd like (which could mean malfunctioning patrons for some time to come).

This is all very common among the hosting industry, though my host gave a huge red warning about interruptions and stuff (they went out of their way to explain the issues, very likely they got tired of having to explain it to people who didn't know already). I'd like to be surprised that your hosting provider didn't, but in honest they're probably charging <$5 a month for basic hosting packages (SSL, Domain name, IP, etc all extra) and are betting they wont piss you off enough to make you leave.

  • So it is DNS related? Apr 30, 2013 at 18:38
  • Could you expand on your answer? I'm genuinely intrigued as I've never had DNS issues when buying an SSL cert and I'd certainly like to avoid it in the future. How does buying an SSL cert affect your DNS namespace if they have no control over it? Apr 30, 2013 at 18:38
  • HostGator did mention that they would be giving us a dedicated IP address along with the certificate. did it. They used to have DNS for your server www.doodlesculpt.com pointing to one of their shared servers. When you ordered an SSL certificate, they had to give you a unique not-shared IP address, and change your DNS to point to it, so DNS caching servers round the world are returning the old one until their cache expires (24-48 hours tops, usually). Except some random IP that we weren't even using in the first place. - how sure of that are you? Apr 30, 2013 at 18:52
  • IMHO, if hostgator provide your DNS and hosting then switched off the shared vhost before the TTL of your DNS records then its a big error on their part - this is such a simple thing to get wrong!
    – symcbean
    Apr 30, 2013 at 22:00
  • 1
    @symcbean I though much more of you than that. Pretending the up-front monetary expenses are the only cost of a system is just ignorant. Linux admins cost more than Windows admin, 3rd party support costs more, there are less options available (not that they're all good, but certainly in total), user training, hardware support... We were talking about ongoing monthly costs of shared hosting vs value, and you pulled out an under-informed opinion on major operating systems. At Hostgator's size and notoriety they can afford to treat customers poorly too. So disappointed. =[
    – Chris S
    May 2, 2013 at 0:46

While the other answers deal with the change from a shared IP to a dedicated IP to support SSL, there is one thing that was missed.

You have four nameservers for your domain:


The IP address returned by the HOSTGATOR.COM servers does not agree with the address returned by MONIKERDNS.NET, until this is fixed people are going to randomly get sent to the wrong place.

  • Ahhh, there's that "random" IP address. Thanks for pointing that out! That's going to save me a lot of headaches. Apr 30, 2013 at 19:49

Yes, this is normal.

With HTTP you send a HTTP (not HTTPS) GET header, where you say which page you want, and also from which domain you want it. Sending the domain in the header, makes it posible to serve data for several domain on one webserver.

With HTTPS you first have to verify the certificate, and then send the request, so the webserver has no idea which domain are you trying to access when you initiate the handshake, so it is possible to have only one domain (one certificate) on one webserver* (*this is fixed with SNI, which is sadly still not supported on some browsers, eg. IE6, android browser on 2.x versions, etc.)

So, for your HTTPS webpage to work on all browsers, it has to be on a separate IP (no other https pages can use it), so your DNS entries have to point to that new IP.

Depending on your TTL setting, it takes some time to redistribute your IP address change.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.