Applicable to:
- Plesk for Linux
Symptoms
-
All websites show the error:
PLESK_INFO: 421 Misdirected Request
-
The following error message is logged in domain's log (Plesk > Domains > example.com > Logs):
CONFIG_TEXT: AH02032: Hostname default-203_0_113_2 (default host as no SNI was provided) and hostname www.example.com provided via HTTP have no compatible SSL setup
Cause
In recent Apache version, Apache team has released fixes for CVEs that affected Apache + nginx functionality: new changes do not allow Apache process requests from nginx without the server name (by default, nginx does not pass the server name through SNI when establishing a connection with a proxied HTTPS server).
This issue has been addresses in Plesk Obsidian 18.0.70 and later releases.
Resolution
Update Plesk Obsidian to the latest build.
Note: The hotfixes are compatible with the manual workaround. So, even for servers where manual solution is already applied, no extra steps are required after installing Plesk update.
Manual workaround for previous Plesk versions:
Add proxy_ssl_server_name, proxy_ssl_name and proxy_ssl_session_reuse directives in nginx configuration to make nginx pass the server name to Apache through TLS Server Name Indication (SNI) extension:
- Connect to the Plesk server via SSH.
-
Run the script (without any modifications):
# echo -e "proxy_ssl_server_name on;\nproxy_ssl_name \$host;\nproxy_ssl_session_reuse off;" > /etc/nginx/conf.d/fixssl.conf && systemctl restart nginx
Comments
As per Thomas, for now I have stopped the nginix proxy service and now all sites are working. Ask “AI” (anything but) how to do this it will tell you to disable proxy mode, which disables Apache not Niginx. Tell it it's wrong and then it comes up with the right answer. Usual AI rubbish!
Really, how can this happen? Didn't anyone learn lessons from CrowdStrike? Test it!!!
regisit, I think the issue is that Apache is now more strict when it comes to proxies and requires the upstream server (nginx) to specifically state which website is trying to access during the SSL handshake. The Nginx config on Plesk was not configure to pass this onto Apache so Apache throws the toys out the pram.
The fix posted by the OP creates a fixssl.conf file with 2 extra directives “proxy_ssl_server_name” and “proxy_ssl_name” which pass on the hostname of the requested website to Apache. Far as I can see it is the proper fix for this issue. I reckon Plesk may incorporate this into a future update rather than have it sit in fixssl.conf just for tidiness purposes.
This is the dilemma between the need for rapid security updates and the occurrence of very rare but potential complications.
Some informations for “older” distrubutions:
Ubuntu 16.04 LTS: Not affected
Ubuntu 18.04 LTS: affected; Fix does NOT work. It seems like the proxy_ssl_name $host; directive just works globally under this version and it only is set with the first domain/server, you connect to, after restarting the webservices. Only solution was to deinstall nginx and only use apache2.
Ubuntu 20.04 LTS: affected, fix does work.
Ubuntu 22.04 LTS: affected, fix does work.
Ubuntu 24.04 LTS: affected, fix does work.
IT Dept, thanks, useful info. So actually this is a Plesk mess - no testing of the update they issued that included updating Apache. Given default Plesk setup is Apache proxied by Nginix, this is unforgivable.
We have multiple servers each running multiple sites but this fix didn't work on one - only first site visited after restarting nginx proxy worked. Most of our servers are dedicated, this one is an Ionos Cloud Server hosting multiple sites. We have another cloud server hosting a single site that's working fine. I'll raise with Ionos but any ideas?
Yes - Ubuntu 18.04 LTS is used here (with esu of course;) )
Wolfgang Freudenberger we have the issue of it only working for one site on 20.04.6. Single IP.
I faced the 421 Misdirected Request on all sites today after the Apache update. I applied the recommended fix by logging in as root using SSH and run:
echo -e "proxy_ssl_server_name on;\nproxy_ssl_name \$host;" > /etc/nginx/conf.d/fixssl.conf && service nginx restart
That resolved the issue immediately ✅
Thanks for saving time
regisit same issue here.
Please post if you find a solution. For now, disabling nxginx make websites accesible
regisit interesting - I have x3 IONOS VPS accounts and the fix has worked on all of them, via that same command. I remain nervous about this… hot fixes and the like do the job.. but are unsettling! Hope you find a solution. Have you tried the “Remove nginx.. then add it again” approach instead that others have mentioned? (that came in after I'd already done the echo command / SSH etc.).
I had the same problem this morning, but this solution fixed it on Ubuntu 22.04.5 LTS. Thanks!
Fix works, thank you!
I just used the suggested resolution in PuTTY and it worked straight away for me. Thanks
The fix worked for me as well. However, since almost all subdomains weren’t working, I had to follow up with a 'service apache2 restart' — and now everything is running smoothly.
Hi all, so my understanding is that this must have rolled out via an update and like many others I have auto updates disabled on Plesk (for various reasons) so I was scratching my head thinking how did Apache magically change its inner workings. I checked the apt history log on my server and it shows an unattended upgrade happened just before the websites went down. I checked the apt config and low and behold, unattended upgrades was enabled.
I am 100% certain I did not enable unattended-upgrades, nor did any other admin on my team. I can only assume as part of Plesk's install it enables unattended upgrades? Can anybody confirm this?
P.S. I reckon its best not to disable unattended upgrades and let Plesk roll out a fix or explanation as to how Apache got updated by itself.
also not working on 20.04
all others seem fine
apply the patch.. it works for 1 site.. not for others
The quickest solution is to simply uninstall nginx under (extensions) for the time being. Everything will then run smoothly again.
AH02032: Hostname default (default host as no SNI was provided) and hostname **** provided via HTTP have no compatible SSL setup
This domain is behind cloudflare, without cloudflare DNS (for the SAME domain) it's working ok.
We don't have nginx installed and bug is still there (no update available)
Error message is
Our apache version is apache2 2.4.52-1ubuntu4.15
Thanks for quick fix.
Had the same problem this morning and was starting to panic when starting to read up about SNI . This resolution looks like a good one and stops the following message being displayed:
Thank you
The command worked for two of our servers - but the third is showing Server Error
502
Bad Gateway
Web server received an invalid response while acting as a gateway or proxy server.
ANyone any ideas as to how to fix this?
Workaround worked - Thanks!
I updated Plesk and with trying the fix
"echo -e "proxy_ssl_server_name on;\nproxy_ssl_name \$host;" > /etc/nginx/conf.d/fixssl.conf && service nginx restart"
i'm getting “no such file or directory” - how to find the fixssl.conf?
By looking into /etc/nginx/conf.d, in only see "ssl.conf"
any ideas?
Current workaround is not working if we're using cloudflare as proxy (no nginx)
I have 19 sites down becauise of this stupid mess.
I can confirm happen to me this morning only one of my Sites with EV SSL failed… First time this ever happened but thankful for this quick resolution thank you team.
Thanks alot! Its works
If it can be useful… disabling webshield of immunify360 solves the problem (not using nginx, using cloudflare)
(still not a decent solution)
Why would Plesk not be monitoring beta streams for these packages and testing before a critical failure like this occurs? This is not the first time a bad apache2 or httpd package was released and caused this type of issue, and here we are again.
Hi all after applying the workaround, I facing another Apache Error which cause the “AH01071: Got error ‘empty string to a string offset in…..” Its a Warning type error but its cause the website not able to show all the css and picture files. I’m using WordPress of it. Any one also facing the same problem ?
This site can’t be reached
sunset-usa.com took too long to respond.
Try:
ERR_CONNECTION_TIMED_OUT
Please sign in to leave a comment.