3

I woke up this morning and started getting emails from customers of my website truckercert.com that "the site is down". But what actually happened is the SSL certificate quit working. The website runs on a Bluehost VPS and I have full (root) access to WHM and cPanel. I called Bluehost. The VPS tech support person was clueless both as to what caused it or how to fix it. She did, however, point out that there are some IP mismatches going on that could be at the root of the problem:

enter image description here

Notice how my domain resolves to two different IP addresses. This just started happening today. The wrong IP (204.11.56.48) now maps to an old domain I used to own (usaarbiters.com), and that domain also used to be the Primary Domain on my Bluehost account. So I guess it's no shock that this problem caught up with me. The correct IP for truckercert.com is 198.154.243.158.

This domain's (truckercert.com) SSL cert has been created and renewed automatically by Let's Encrypt through Bluehost for the past 2 years or so. I abandoned the domain usaarbiters.com over a year ago, but maybe someone just bought it, it resolves to a new IP, and maybe Let's Encrypt tried to renew the cert and got confused.

  1. Is there a way in WHM or cPanel to remove all old references to usaarbiters.com so that truckercert.com doesn't have any link to that wrong IP?
  2. After solving #1 above, is there a way to force Let's Encrypt to re-issue a correct SSL cert through WHM or cPanel (or some other way)?

Any help will be greatly appreciated.

7
  • 2
    Your DNS seems to be set up correctly as far as I can tell. The only thing I don't like is that your DNS host only has one DNS server. ns1.zerogravpro.com and ns2.zerogravpro.com both point to the same IP address (198.154.243.158). Ideally you would use a DNS host that has multiple servers that are in separate cities. Sep 2 at 17:08
  • 1
    It looks like you may be hosting your own DNS which is a really bad idea. Blue host does have DNS servers that you can use: bluehost.com/help/article/… Sep 2 at 17:11
  • 3
    Look no further than dnsviz.net/d/truckercert.com/YTEFcg/dnssec : it shows warnings because you are in a lame delegation setting which means a mismatch between what the parent of your domain thinks on what your nameservers are and what your own zone says nameservers are. You have to resolve this first, any other DNS debugging is useless until you fix this. Lame delegation cases are the prime cause for observations where results differ (because some recursive nameservers are child centric others are parent centric so the results will depend on which nameserver is queried) Sep 2 at 17:11
  • 1
    Patrick: Your info seems very promising, but how can I solve that? Is there something in WHM I can modify to fix it? Stephen: My domain is at NameCheap and my Nameservers are set to ns1.bluehost.com and ns2.bluehost.com. So I'm not sure where you're seeing zerogravpro nameservers. Sep 2 at 20:04
  • 1
    "but how can I solve that?" 1) Decide once for all who is providing DNS services for your domain (but see Stephen comment: do not attempt to do DNS yourself if that is not your expertise, better to use external providers, your registrar, or any other company) and then 2) update, through registrar, the list of nameservers for your domain based on 1) so that the registry published the relevant list and they are configured properly. Sep 2 at 21:16
3

Namecheap is the registrar, and my nameservers are set to ns1.bluehost.com and ns2.bluehost.com.

But the DNS zone on the authoritative nameserver that the parent/registrar points to (at Bluehost and accessible via WHM > DNS Zone Manager) would appear to have two conflicting NS records pointing to ns1.zerogravpro.com and ns2.zerogravpro.com (basically do a DNS lookup on your domain and look for NS records). The SOA record (specifically, the MNAME subkey - primary nameserver) would also appear to be referencing this "incorrect" nameserver.

(At least you did, you seem to have now corrected this?)

These should all point to the same. This is likely to be what is causing the inconsistent behaviour.

As @PatrickMevzek mentioned in comments:

a mismatch between what the parent of your domain thinks on what your nameservers are and what your own zone says nameservers are

In WHM the relevant DNS zone can be accessed via "DNS Zone Manager" (under "DNS Functions"). For the required domain select "Manage". This gives you total control to edit, add and remove DNS records within this zone.

How is this doing my own DNS?

Both ns1. and ns2.zerogravpro.com point to the same (single) IP address and the same IP that your domain (A record) points to (ie. the webserver that serves your website) - so it can't be a dedicated DNS host (if it's a DNS host at all) and would look like you are perhaps "doing your own DNS".

Reference:

The following question on ServerFault goes into great detail about the differences and role of the Nameserver records defined at the registrar (the parent) and the NS records defined in the authoritative DNS (that the parent points to).

4
  • 1
    This sounds correct, thank you. I couldn't verify because Bluehost went in and fixed all of it. What I was looking for was something like "open WHM, go to this place, change these settings". Sep 4 at 14:15
  • @HerrimanCoder I've updated my answer with a bit more information about the SOA record and finding this in WHM. Just to add, I don't know where usaarbiters.com was coming from - I don't recall seeing any mention of this in the DNS lookup. My guess would be that this was the result of an out of date cache due to a failed DNS update?
    – MrWhite
    Sep 4 at 16:12
  • 1
    The SOA MNAME might be wrong but technically it has no impact during resolution (it is not used). So it can be an hint towards invalid configuration, but just as such can not cause problems. Sep 4 at 16:49
  • MrWhite, thank you for the excellent and detailed answer. It all makes sense now. Sep 5 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.