19

I am setting up a website and bought the SSL certificate for the domain of the website. When I asked the hosting company why https://www.example.com was refusing connections, they answered that SSL access was configured on port 41696. Of course, https://www.example.com:41696 works as they promised, but that's really not a URL I'd like to use for a customer facing website.

The hosting company also said that they can't change it to 443 even if we get a different package. I have never heard that from any other hosting providers I worked with. Is there a good reason why they are not letting that happen? Or is there any configuration that I can change on the server that will make it accept HTTPS requests on port 443?

Improve this question
13
  • 44
    There is no good reason for that. Do not give them any money, and go find another provider.
    – Michael Hampton
    May 11, 2016 at 7:50
  • 4
    Concur. No good reasons to do this, several very good reasons not to. That said, I'd love to hear their explanation for it...
    – Shadur
    May 11, 2016 at 8:29
  • 12
    Sounds like they're idiots - please feel free to name and shame them so that others don't make the same selection mistake you did. Seriously.
    – Chopper3
    May 11, 2016 at 8:48
  • 2
    Please see my answer on this other post for additional reasons why serving a public-facing HTTPS site over a non-standard port is a terrible, terrible idea. Definitely switch hosting providers.
    – MonkeyZeus
    May 11, 2016 at 12:42
  • 3
    I really don't understand why this question hasn't been closed. It's not about system administration. Why $unnamedcompany does $thing can only reasonably be answered by $unnamedcompany. Everything else is guessing and we don't do that here.
    – user9517
    May 11, 2016 at 16:07

3 Answers 3

Reset to default
28

Historically, HTTPS required a dedicated IP per site/certificate, since the browser needs to verify the certificate before sending the Host header. It's possible that your hosting provider uses dedicated ports instead, in order to conserve IPs.

Nowadays, however, pretty much all modern browsers support Server Name Indication, which allows virtual hosting multiple HTTPS sites on the same IP and port, so even that isn't a particularly good reason anymore. If this is a shared hosting service, it's unlikely that there are any config changes you can make to make your site be available on the default port.

Improve this answer
3
  • 1
    This is it. :) There is nothing weird with that, just an old provider with its old limitations. Switch your provider and get you certificate renewed.
    – Daniel
    May 11, 2016 at 10:30
  • 5
    @Daniel In my opinion doing this in 2016 is 'weird'. The corresponding RFC dates back to June 2003 (!) These are thirteen years. (Yes, I know that it takes some time between doing requests for comments and the actual implementation, but if this is the reason the environment of the provider looks like it does, then this is way too much time (in my opinion).)
    – gxx
    May 11, 2016 at 14:22
  • 7
    Just to add for completeness, SNI is supported by all major browsers, but many business tools, older app servers and even some modern libraries do not properly support SNI. Be sure to research this and get the facts based on your specific use case.
    – Aaron
    May 11, 2016 at 16:16
9

tl;dr: Switch the provider, this one seems a bit weird.

Is there a good reason why they are not letting that happen?

Depends on what one thinks is "a good reason", but in my opinion: No.

Or is there any configuration that I can change on the server that will make it accept https requests on port 443?

If the provider is blocking / filtering access, sadly, you can't do anything about this on your side.

Improve this answer
7

Possible explanation:

There are at least some providers who sell you virtual machines which have their distinct IPV6 addresses, but a shared IPV4 address. One example is this (this link should in no way be seen as an endorsement or advertisement). You typically get a few port forwards, but thery're TCP based (no SNI, HTTP host header or anything), so the port number is the only way to select "your" host.

With IPV4 addresses becoming rarer and rarer, this is one way of saving on them.

If the website is for a charity or similar organization which has few funds, and you absolutely have to stick to the lowest price possible, you can probably set up a free cloudflare plan that forwards your-domain.com:443 to your 41696 port.

If not, get a different hoster.

Improve this answer
4
  • 1
    Cloudflare won't do the port forwarding.
    – Canadian Luke
    May 11, 2016 at 17:17
  • 5
    It is easy to forward HTTPS with SNI in this scenario (e.g. with haproxy); if the provider does not do so then they are either lazy or incompetent. Either way you don't want to give them your money.
    – Michael Hampton
    May 11, 2016 at 21:52
  • 1
    I guess if I offered a vps at £2.50 annually, i'd be too lazy to do any customer-specific configuration as well. Of course, such a vps is arguably not a good platform for a company website that has any reliability requirements. So agree: run your website elsewhere.
    – Guntram Blohm
    May 11, 2016 at 22:08
  • @CanadianLuke but if you give cloudflare only the IPv6 IP, they will do the IPv4->IPv6 forwarding.
    – Josef
    May 17, 2016 at 9:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.