421 Misdirected Request error across multiple domains despite valid SSL (WHM/Apache SNI issue)
Hello,
We are facing a persistent issue with SSL on our WHM/cPanel server. Several domains on the same server/IP are returning the following error intermittently in browsers:
421 Misdirected Request
The client needs a new connection for this request as the requested host name does not match the Server Name Indication (SNI) in use for this connection.
we arefacing is issue on some domains not on all the domains.
Steps we have already tried:
Reinstalled SSL certificates for all domains (Let’s Encrypt via AutoSSL).
Verified certificates with openssl s_client – each domain shows the correct valid cert.
Rebuilt Apache configuration (/scripts/rebuildhttpdconf).
Restarted Apache service.
Checked WHM → Manage SSL Hosts → all domains appear correctly with valid certs.
Tested with/without Nginx proxy (Engintron).
Despite this, browsers still throw 421 Misdirected Request errors. Sometimes the sites fall back to the self-signed certificate for vps.resumedone.xyz.
It seems Apache is not consistently selecting the right SNI vhost. Running httpd -S shows multiple vhosts, but we are not sure if the correct default SSL host is set.
Questions:
- Is this related to Apache 2.4.65 stricter SNI handling?
- Any fix or patch recommended on WHM/cPanel side to prevent these 421 errors?
Thank you for your assistance.
-
Hey there! Yes, this is almost certainly related to the recent Apache changes. Are you running the CloudLinux operating system at this time?
0 -
No , i am on plain CentOS 7.
0 -
Vijay Vamja - I'm not sure there's much we can do for CentOS 7 at this point so I'd recommend moving to a more modern operating system.
0 -
Could you please provide me with the recommended steps or best practices for migrating from CentOS 7 to a modern operating system that works well with cPanel/WHM? I’d like to ensure a smooth transition while minimizing downtime. Any documentation or guidance would be greatly appreciated.
0 -
It will depend on your access to the server and what your host allows. We have an ELevate tool that offers an in-place upgrade, but if you're on older hardware it may make sense to move to a newer machine entirely.
I would start here and review these guides:
but feel free to make a new thread with any specific migration questions you may have.
0 -
Vijay Vamja
Engintron had been updated way earlier with a fix for this. Just make sure it's up to date on your server as well. No need to rush for an update of your entire server...
0
Please sign in to leave a comment.
Comments
6 comments