3

I am on a shared host (Apache) and am receiving little help resolving this issue. I have a main domain https://www.waldorfteacherresources.com and I have set up two cookieless domains: static.waldorfteacherresources.com and static.mseifert.com. When loading, Firefox shows many of the static files with a 421 response. Occasionally, the main site's index.php comes back with a 421 error - which then gets displayed in the browser directly. Each time when loading a url, the files with 421 errors can vary. Sometimes I get no 421 responses.

Also odd is that even with files having a 421 response, they seem to load anyway: the css files are getting loaded (otherwise the site would not render correctly) and the javascript files appear in the debug tab of Firefox.

I am using Comodo SSL and have PositiveSSL Multi-Domain Certificate. The response I get from my ISP is

After reviewing this it looks like the main issue is your sites code is working in a way that is confusing the server.

It appears for some reason the site is making a request to itself and presenting the host header as www.waldorfteacherresources.com while it is actually going to static.waldorfteacherresources.com.

I have read the discussion on 421 Errors here but this isn't helping me figure out if it is somehow my code creating the problem or if there is something on the ISP end that can be changed (of if I need to find a new ISP). Since it is a shared host, they are not going to change the server configuration.

Below are Firefox's network tab for two loads of the same URL. Any help would be appreciated.

Fresh load of url

Second load of url

  • This is specific to HTTP/2 and TLS. As the last of your link shows, it depends on how each VirtualHost is configured inside Apache. You are exactly in this case because you have a single certificate with all related names as SANs. – Patrick Mevzek Sep 4 '18 at 20:12
  • "Also odd is that even with files having a 421 response, they seem to load anyway" as specified by RFC tools.ietf.org/html/rfc7540#section-9.1.2 : "Clients receiving a 421 (Misdirected Request) response from a server MAY retry the request -- whether the request method is idempotent or not -- over a different connection. This is possible if a connection is reused (Section 9.1.1) or if an alternative service is selected [ALT-SVC]." – Patrick Mevzek Sep 4 '18 at 20:13
  • Can the ISP install 2 separate certificates, one for each name? If so, you may try that instead of a certificate with SANs. – Patrick Mevzek Sep 4 '18 at 20:13
  • @PatrickMevzek I will look into this. Since I bought from Comodo, my guess would be that I need to purchase something different. Not sure what individual certificates are called. Since I have six certificates total (for my 3 sites), this could get very expensive. – mseifert Sep 4 '18 at 20:17
  • 1
    Let's Encrypt certificates are free. You should also give the link you posted here about the answer on these errors to your hoster as it clearly shows the problem is with the Apache configuration, and you do not control it... – Patrick Mevzek Sep 4 '18 at 20:18
2

421 is returned when the browser tries to reuse the connection for another site. This is allowed under HTTP/2 to save the cost of opening another connection as, in most cases, it is better to use fewer connections under HTTP/2.

The browser should only reuse a connection which maps to the same IP address and where the certificate used covers both sites (which is the case for your three sites).

Despite these conditions, occasionally the browser will try to reuse a connection when it shouldn’t. The main case for Apache is if different SSL/TLS settings are set up for each vhost. Looking at ssllabs.com for each of your three domains there setup looks the same so finding it difficult to see why Apache is returning this. You should get in touch with your hosting providing and ask them to verify this.

In these cases Firefox will see the 421 response, establish a new connection and request the resource again. Though, unlike a 301or 302 it looks like this will not show as a separate request in developer tools.

The alternatives to fix this are:

  1. Get the hosting provider to identify the cause and allow the connections to be reused.
  2. Use different certs for each domain (so the browser won’t try to reuse the connection).
  3. Use different IP address for the other domains even if they map to the same server (so the browser won’t try to reuse the connection).
  4. Stop using http/2 - which seems a shame since it’s usually gives a good performance gain.
  5. Stop using other domains, at least for HTTP/2.

I think you should seriously look at the last one. The benefit of using other domains (called sharding) is often overstated in my opinion for HTTP/1 and should not be necessary under HTTP/2.

Sharding is done for two reasons:

  1. To allow 6 more connections under HTTP/1.1 as browsers typical max out at 6 simultaneous connections per domain. However, unless those 7th, 8th...etc connections are used a lot the cost of setting them up may not be worthwhile. And under HTTP/2 the limit is much higher (usually at least simultaneous 100 streams per connection).
  2. Cookie-less domains to save on request sizes. But under HTTP/2, HTTP headers are compressed so you are less worried about this (and again in my opinion the value of this was overstated - how big are cookies really.).

Looking at webpagetest for your homepage, you are loading the main page over the www domain, and then 6 assets over one static sub domain and 6 assets over the next subdomain and the a few more over each:

Waterfall view

Here you can see the true cost of your 421s as nearly every connection has to be restablished with a connect and SSL negotiation. Ignoring this for a bit you can see that, yes iyou are downloading more than 6 resources at the same time over your two static subdomains. So if this was an HTTP/1.1 connection you would benefit from breaking the 6 connection limit for a bit. But you are also wasting the www connection which is idle after the first request. This is made more obvious from the Connection View:

Connection View

So you could get rid of one of those subdomains and serve those assets for the www domain to getting utilization out of that first connection.

For HTTP/2 you can get rid of the other domain too as shouldn’t be needed. You can then either serve different results to HTTP/2 and HTTP/1.1 users but that is complicated, all the main browsers support HTTP/2 and for 24 requests in total it’s not even going to be much of a performance drag going to one domain for those that don’t.

In summary stop sharding to cookieless domains unless you have a real good reason to, as from a quick look at your home page anyway, it is not helping your performance and while you are hitting this 421 issue you are hindering it considerably.

  • Thank you for the detailed answer and time spent looking into it. The Home Page is not a good representation. I can serve a lot of images on a page - sometimes easily over 100 e.g. waldorfteacherresources.com/… At what point is it a "good reason"? – mseifert Sep 4 '18 at 21:34
  • Precisely what HTTP/2 is good at - without needing extra domains and connections! I’m fact, because of this. Firefox tries to automatically unshard for you when using HTTP/2, which is where you see you issue! – Barry Pollard Sep 4 '18 at 21:36
  • Also looking at that page you are serving all the images off of one domain anyway so benefit very little from sharding even under HTTP/1.1: webpagetest.org/result/… – Barry Pollard Sep 4 '18 at 21:39
  • Funny I haven't read any of this with everyone advising for cookieless domains. Maybe that's old content. Seems I will have to go back to just using the one domain as you advise. Seems a shame after all the reading and configuring of code. I am not familiar with the term "sharding" so I'll look into it more. I may try getting Comodo to issue separate certificates for the domains instead of a multi-domain certificate to see if it has any impact. They have a free 30 day return policy and at least I'll know if there is a solution before I go through the effort of re-coding the site. Thanks again – mseifert Sep 4 '18 at 21:44
  • HTTP/2 changes a lot of things. You may be interested in my post here: tunetheweb.com/blog/why-do-we-need-http2. And if that does interest you, then also the book it was an except from :-) – Barry Pollard Sep 4 '18 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.