SSL works on some wifi networks but not others. This site can’t provide a secure connection

Help
1

My domain is:
doranix.cloud

I ran this command:
I successfully registered and set up an SSL with certbot following Digital Ocean's guide: How To Secure Nginx with Let's Encrypt on Ubuntu 22.04 | DigitalOcean

A few days later the website just stopped working with a "This site can't provide a secure connection" message. ERR_SSL_PROTOCOL_ERROR

I have a pretty small sample size but the ssl server seems to work on other wifi networks except for the one I'm currently using.

I renewed my certificates and restarted my ubuntu server and nginx

It produced this output:
DNS propagation checker points to the correct IP: DNS Propagation Checker - Global DNS Testing Tool

SSL Labs also works: SSL Server Test: doranix.cloud (Powered by Qualys SSL Labs)

My web server is (include version):
nginx version: nginx/1.18.0 (Ubuntu)
Ubuntu: 22.04

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:
n/a

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.7.4

EDIT:
So I did a nslookup of my domain and it wasn't directing to the right ip address. When I tried to open the website in an icognito window it said that it was blocked because of a know security threat. So it looks like it's my network and not an SSL issue.

2

Hi @abuhelos, Welcome to the forum.
I can access your site just fine and it seems like your cert is solid till January.

Good Luck with that!

5 Likes
3

Is this the expected IP?:

Name:    doranix.cloud
Address: 24.144.86.73

Which DNS server did you use to see the wrong IP?

2 Likes
4

Yes that's the right ip. I left work (where it's not working) will type that command in tomorrow will let you what the dns server is.

On another note:

I did a test here: doranix.cloud Domain Health

I'm getting blacklisted from UCEPROTECTL3 and SEM FRESH not sure if that has something to do with it. I just added a DMARC this morning so hoping that would get me unblacklisted from those dns servers.

5

Such listings should have nothing to do with the error you are encountering.
You should request delisting directly from each of them.

In case you are not familiar with this free service [completely off topic]...
You can check listings for your domain names/IPs at: https://valli.org/

4 Likes
6

Ok I'm back in the office. I just ran nslookup again and this was my response

Server: 2001:558:feed::1
Address:	2001:558:feed::1#53

Non-authoritative answer:
Name:	doranix.cloud
Address: 104.225.12.42
Name:	doranix.cloud
Address: 104.225.12.29

I'm not sure why it gave me 2 different addresses (and they're both wrong). That makes sense that, the listings aren't causing the error. The SEM FRESH errors I'm getting are for my domain being less than 10 days old, and the UCEPROTECT errors seem to be invalid according to this: The UCEPROTECT RBL Email Scam Explained | InMotion Hosting

7

Which DNS servers are you using?

3 Likes
8

I think 2001:558:feed::1 is comcast? Our internet provider is comcast. Used NameCheap for domain name

9

Try using Google DNS or Cloudflare DNS or any other DNS.

4 Likes
10

Following the DNS tree, I get:

nslookup -q=ns cloud. a.root-servers.net.
shows:

cloud nameserver = ns1.uniregistry.net
cloud nameserver = ns2.uniregistry.info
cloud nameserver = ns3.uniregistry.net
cloud nameserver = ns4.uniregistry.info

nslookup -q=ns doranix.cloud. ns1.uniregistry.net.
shows:

doranix.cloud nameserver = dns1.registrar-servers.com
doranix.cloud nameserver = dns2.registrar-servers.com

nslookup -q=a doranix.cloud. dns1.registrar-servers.com.
shows:

Name:    doranix.cloud
Address: 24.144.86.73
3 Likes
11

It worked. Is that something in my control or do I need to call Comcast about their DNS servers?

I did ns lookup again and it gave me the wrong ip address still. Not what I was expecting.

Server: 8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	doranix.cloud
Address: 104.225.12.29
Name:	doranix.cloud
Address: 104.225.12.42
12

All other public DNS servers show the right IP.

3 Likes
13

Thanks for the help. Dealing with comcast customer support right now, they think it might be a modem issue.

This is what I get when I type the same commands.

nslookup -q=ns cloud. a.root-servers.net.
shows:

Server:	a.root-servers.net.
Address:	2001:503:ba3e::2:30#53

Non-authoritative answer:
cloud	nameserver = ns2.uniregistry.info.
cloud	nameserver = ns3.uniregistry.net.
cloud	nameserver = ns4.uniregistry.info.
cloud	nameserver = ns1.uniregistry.net.

Authoritative answers can be found from:
ns1.uniregistry.net	internet address = 64.96.1.1

nslookup -q=ns doranix.cloud. ns1.uniregistry.net.
shows:

Server:		ns1.uniregistry.net.
Address:	2620:57:4000:1::1#53

Non-authoritative answer:
*** Can't find doranix.cloud.: No answer

Authoritative answers can be found from:

nslookup -q=a doranix.cloud. dns1.registrar-servers.com.
shows:

Server:	dns1.registrar-servers.com.
Address:	2610:a1:1024::200#53

Non-authoritative answer:
Name:	doranix.cloud
Address: 104.225.12.42
Name:	doranix.cloud
Address: 104.225.12.29
15

This is unexpected:

That should provide an authoritative reply.

Maybe it has to do with .net responding for .cloud
If so, it can be ignored.
[I'll have to brush up on my DNS - give me a few to confirm/deny this]

4 Likes
16

OK, that can be ignored.
It has everything to do with .TLD1 responding for requests on .TLD2

What threw me off was that you cut off the reply [after "can be found"]:

2 Likes
17

Comcast has a DNS based edge security service that is known to break DNS. It can only be disabled by contacting Comcast and it has a known history of re-enabling itself.

4 Likes
18

It was exactly this. Had Comcast disable security edge and it works now. Thanks.

Apparently because my domain name is newer and doesn't get a lot of traffic, it's not considered safe by security edge (according to tech support rep).

Sounds like it's redundant because we have a firewall and then the security edge on top of that.

2 Likes
19

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.