3

My site gives this error when I try to visit, both on windows and ios. The thing is that it doesn't always happens, some days it works fine and the other it doesn't. Does anyone know what could be the cause?

My site is healthprovement.com Subdomains do work, so it only a problem for the main site.

I've looked at ssl testers but they weren't able to load the site or didn't find anything wrong.

I've recently changed some CNAME, and added subdomains. Maybe this could be something to do with it.

  • "I've recently changed some CNAME, and added subdomains. Maybe this could be something to do with it." In general, for proper troubleshooting, in cases like that (even if mostly unrelated here), you should specify what you did change exactly and when. Otherwise it is impossible to derive any fact based on such statement. – Patrick Mevzek Jan 23 at 14:36
3

Your DNS has two IP addresses specified for your site. Only one of the two has a server with properly configured security certificates.

When you have two A records for the same host name, it is known as "round robin" DNS. Clients will randomly try to connect to one or the other. Some modern browsers may try both of them to see which works, which may be why you are not seeing the problem in some browsers.

$ dig healthprovement.com
healthprovement.com.    7069    IN  A   108.179.232.43
healthprovement.com.    7069    IN  A   148.105.251.16

The 108.179.232.43 server is working:

$ curl --head --resolve 'healthprovement.com:443:108.179.232.43' https://healthprovement.com/
HTTP/2 200 

But the 148.105.251.16 is not:

$ curl --head --resolve 'healthprovement.com:443:148.105.251.16' https://healthprovement.com/
curl: (35) error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

To fix this problem, you either need to remove the DNS A records pointing to 148.105.251.16 or you need to fix that server so that it handles the HTTPS requests properly.

  • 1
    ssllabs.com/ssltest/analyze.html?d=healthprovement.com shows it too. 108.179.232.43 is shown as "Ready" and "Grade A", while 148.105.251.16 has the message "Failed to communicate with the secure server " – Patrick Mevzek Jan 23 at 14:36
  • I removed the A records, now the SSLtest sees my site, and also gtmetrix sees my site, this is what I use to create a waterfall chart. But I still can't see my site myself. I used Chrome and safari – B kav Jan 23 at 16:45
  • 1
    It looks like your TTL was set for 14400 seconds. It could take 4 hours for the problem to totally clear from all DNS caches. – Stephen Ostermiller Jan 23 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.