0

I have enabled TLS1.3 on three servers that are behind another load balance server that has itself TLS1.3 enabled. I get different results if the domain name is written without www. All servers have active ssl certificates. Here are the test results when testing in cdn77 checker:

I get "Excellent" if www.waylisting.com is tested. However, I get "Poor" in Firefox and "Moderate" in Google Chrome if waylisting.com is tested without www.

I have no errors regarding ssl when testing in gmetrics, pingdom, and so on. What am I missing in my configuration

  • Without access to the config file, this is impossible to answer. Even then, I would thing this is more a question for Server Fault. – MechMK1 May 21 at 10:38
2

There is an inconsistent setup of the site. Currently a DNS lookup for the site returns 5 IP addresses and each DNS lookup returns these in a different order (i.e. DNS based load balancing), which means that multiple attempts to reach the site might actually reach different servers.

These servers seems to be configured differently. From the SSLLabs report:

 172.104.210.88       Grade B
 172.104.22.58        unreachable
 45.79.155.107        Grade A+
 172.104.16.205       Grade A+
 172.104.219.176      Grade A+

And SSLLabs also adds a big warning

Warning: Inconsistent server configuration

The A+ grades are for servers which have TLS 1.3 enabled. The grade B is for a server with no TLS 1.3, incomplete certificate chain and broken HSTS policy.

So it looks like that you've properly configured some systems but not others. Given that both www.waylisting.com and waylisting.com return the same 5 IP addresses but likely in different order it might happen that the testing can see different results for both domains, depending on which of the servers they actually end up testing.

  • And the same (addresses and results) for the www. version; the cert's SAN covers waylisting.com *.waylisting.com. SSLLabs also reports a redirect loop on the first address (which isn't strictly a TLS problem). – dave_thompson_085 May 21 at 4:30
  • Thanks so much for helping. The problem was within the load balancing server for "server name" declaration. I had an extra server name that was not needed. Once removed CDN77 checker reports A+ for all servers, except the unreachable one because it is turned off and not fully configured yet. Again thank you for your diligence and patience. The issue is solved. – user208479 May 21 at 11:38

protected by Community May 21 at 11:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.