DNS Cluster SSL connection failed / Could not communicate with remote API server.

Symptoms

The DNS Cluster "status" shows the following for all Cluster members:

CONFIG_TEXT: Could not communicate with remote API server.

The cPanel error log shows errors such as the following as well:

CONFIG_TEXT: Could not connect to https://203.0.113.2:2087/json-api/batch: SSL connection failed for 203.0.113.2: hostname verification failed

Cause

By default, DNSAdmin now connects via an SSL connection to DNS Cluster members; however, DNSAdmin is still configured to use the IP address to communicate with the remote servers. As a result, various API commands will fail as the remote IP cannot be covered by an SSL.

We've opened an internal case for our development team to investigate this further. For reference, the case number is CPANEL-53390. Follow this article to receive an email notification when a solution is published in the product.

Resolution

A change was briefly introduced into the DNS Cluster flow that enforced SSL verification on DNS Cluster peers. While this change was active, the "Enforce SSL peer verification for DNS cluster peers" option in Tweak Settings could be used to return to the old behavior. This was reverted in future updates; if your server is experiencing these errors, you should ensure you are on the latest version of cPanel to fully resolve the issue.

If you cannot update yet, and the option is available in "Tweak Settings," you can disablie it manually via WHM (if the server is not a DNSOnly server) or via API: