Skip to main content

Update about the Apache 421 error situation

cPRex Jurassic Moderator
  • Edited

 

A recent update in Apache 2.4.64 introduced a bug fix that inadvertently caused HTTP 421 errors in many common proxy configurations. To prevent widespread disruption, we temporarily rolled back the change, giving both Apache and our team time to address the issue properly in version 2.4.65.

For customers using ea-nginx, we've implemented a workaround by switching the proxy protocol from HTTP/1.1 to HTTP/1.0. This mitigates the issue for now, but depending on your setup, you may still encounter some side effects.

🔍 What You Might Experience

  • If you're using ea-nginx: You may notice limitations with HTTP/1.1 features, such as WebSockets.

  • If you're using another proxy: You might encounter intermittent HTTP 421 errors until your proxy is adjusted to accommodate Apache’s updated behavior. There may be side effects from their solution.

🛠 Technical Details

For a deeper dive into the root cause and technical explanation, please refer to the following article: https://github.com/CpanelInc/ea-nginx/blob/main/docs/Apache-2.4.64-421.md

🧪 How to Verify Your Setup’s Behavior

To safely test the updated Apache and NGINX configuration before deploying to production, follow these instructions:

  • RPM .repo file : http://ea4testing.cpanel.net/Apache-2.4.64-421.repo

    • wget http://ea4testing.cpanel.net/Apache-2.4.64-421.repo -O /etc/yum.repos.d/Apache-2.4.64-421.repo
    • yum clean all

  • Deb .list files

    1. http://ea4testing.cpanel.net/Apache-2.4.64-421.xUbuntu_24.04.list

      1. wget http://ea4testing.cpanel.net/Apache-2.4.64-421.xUbuntu_24.04.list -O /etc/apt/sources.list.d/Apache-2.4.64-421.xUbuntu_24.04.list
      2. curl -fsSL http://ea4testing.cpanel.net/Apache-2.4.64-421/xUbuntu_24.04/Release.key | gpg --yes --dearmor | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/ea4testing.gpg --import
      3. apt update

    2. http://ea4testing.cpanel.net/Apache-2.4.64-421.xUbuntu_22.04.list

      1. wget http://ea4testing.cpanel.net/Apache-2.4.64-421.xUbuntu_22.04.list -O /etc/apt/sources.list.d/Apache-2.4.64-421.xUbuntu_22.04.list
      2. curl -fsSL http://ea4testing.cpanel.net/Apache-2.4.64-421/xUbuntu_22.04/Release.key | gpg --yes --dearmor | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/ea4testing.gpg --import
      3. apt update

    3. http://ea4testing.cpanel.net/Apache-2.4.64-421.xUbuntu_20.04.list

      1. wget http://ea4testing.cpanel.net/Apache-2.4.64-421.xUbuntu_20.04.list -O /etc/apt/sources.list.d/Apache-2.4.64-421.xUbuntu_20.04.list
      2. curl -fsSL http://ea4testing.cpanel.net/Apache-2.4.64-421/xUbuntu_20.04/Release.key | gpg --yes --dearmor | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/ea4testing.gpg --import
      3. apt update

You can ignore apt update’s gpg warning, which will look similar to this:

W: GPG error: http://ea4testing.cpanel.net/Apache-2.4.64-421/xUbuntu_22.04 ./ InRelease: The following signatures were invalid: BADSIG ACFD2F50F8D0C701 EA4 Tool (This is used by `et pub` to sign debs) <ea4-tool@cpanel>

Also you may need to adjust permissions on /etc/apt/trusted.gpg.d/ea4testing.gpg

Comments

2 comments

Date Votes
  • cPRex Jurassic Moderator

    UPDATE - our team was originally going to release this change on Wednesday, July 30, but at this time the release has been delayed.  We'll be working on additional communication related to these changes and I'll post additional updates as soon as I have them.

    0
  • cPRex Jurassic Moderator
    • Edited

    UPDATE

    I know there was some hesitation about the Apache release that was originally scheduled today as many users had requested more time in order to test their systems and make sure things were working well with the changes.

    We are now planning to send an official communication August 6th and then release the update August 11.  At this time we have confirmed that Apache only, NGINX ➜ Apache, CF ➜ Apache, CF ➜ NGINX ➜ Apache are all good to go.  Cloudflare has also fixed things on their end so there are no adjustments needed from us for things to work there.

    Keep an eye out for the official announcement early next week!

    0

Post is closed for comments.

Didn't find what you were looking for?

New post