CloudFlare proxied websites don't work on Virgin Media but do on EE and some U.S providers

[dohlman]

I have a major problem, and Cloudflare are deliberately delaying replies, and dont want to do tech support by phone. Waiting for replies to emails is like watching paint dry, they just don’t care!

Around 4 days ago, I updated my DNS websites on GoDaddy to go through Cloudflare and then set about setting up SSL using a Cloudflare self signed certificate to add SSL to all of my sites.

The DNS move worked like a charm and my sites are now being proxied via Cloudflare.

Now the SSL or HTTPS is a problem.

I am using Virgin Media, and on my cell phone I am using EE.

If I access the websites via EE, the SSL pops up just fine, when I do the exact same thing through Virgin Media the SSL is not working.

When accessed via EE it shows secure, and using “TLS 1.3”.
When Accessed via Virgin Media, it does not saying “Connection is not secure”.

It also says:

"Your connection is not private

Attackers might be trying to steal your information from thednclan.net (for example, passwords, messages or credit cards). Learn more

NET::ERR_CERT_AUTHORITY_INVALID"

I am not sure what is going on, and also I cannot access my emails via email clients such as AquaMail in both instances and I mean both providers.

I am not sure what is going on.

NOTE: I have another domain which is set up in the exact same way as the domain above, aside from the certificate being different (different domains) and it works just fine.

[dohlman]

Isn’t it funny how this is being deliberately delayed!

[fritex]

@dohlman

4 days ago

It could be the DNS propagation issue, if so, or a DNS cache.

@dohlman

self signed certificate

@dohlman

Now the SSL or HTTPS is a problem.

May I ask what kind of SSL option have you got selected under the SSL/TLS tab for your domain at Cloudflare dashboard? (Flexible, Full, Full Strict ...)

Here is a way to re-check if you correctly setup the SSL for your domain with Cloudflare:

Deprecated - Step 2: Setting up SSL with Cloudflare

This tutorial is deprecated in favour of Get started with SSL/TLS · Cloudflare SSL/TLS docs

Archive

This tutorial covers getting SSL working with Cloudflare in various different scenarios. This assumes you already have your website set up on Cloudflare with all your DNS records set to , if not - please visit <a href="https://community.cloudflare.com/t/64309">Step 1</a>. Do you want the website to use HTTPS? Yes Do you already have a valid SSL certificate installed…

If any other issues appear, follow the needed steps for troubleshooting from article below:

Deprecated - Troubleshooting SSL/TLS issues

This tutorial is deprecated in favour of Troubleshooting · Cloudflare SSL/TLS docs

Archive

This tutorial post covers the steps you should take if you have enabled Cloudflare, but HTTPS is not working on the site. If your main domain is secure, but a subdomain is not, please see <a href="https://community.cloudflare.com/t/ssl-tls-not-working-on-subdomain/75181.">https://community.cloudflare.com/t/ssl-tls-not-working-on-subdomain/75181.</a> 1. Check that the DNS record is se…

Regarding available SSL options at Cloudflare dashboard, check here:

Deprecated - SSL/TLS app Settings

This tutorial is deprecated in favour of Get started with SSL/TLS · Cloudflare SSL/TLS docs

Archive

SSL/TLS Configuration Video: This tutorial covers basic settings in the SSL/TLS app of the Cloudflare Dashboard, including SSL Mode [Off/Flexible/Full/Full (Strict)], Cloudflare Origin Certificates, ‘Always Use HTTPS’ and ‘Automatic HTTPS Rewrites’. The settings covered here can all be found by visiting <a href="http://Cloudflare.com">Cloudflare.com</a>, logging in, selectin…

In case you do not have an SSL certificate, you can use Cloudflare SSL, if so, kindly make sure you follow the instructions as follows on the below article to setup an SSL certificate using Cloudflare CA Origin Certificate:

• Origin CA certificates · Cloudflare SSL/TLS docs

Last but not least, kindly have a look here for more information regarding correct SSL settings:

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

@dohlman

NET::ERR_CERT_AUTHORITY_INVALID

May I suggest looking into below article for a solution:

Community Tip - Fixing NET::ERR_CERT_AUTHORITY_INVALID

Error Try the suggestions in this Community Tip to help you fix NET::ERR_CERT_AUTHORITY_INVALID when visitng a site running Cloudflare. Background The Error NET::ERR_CERT_AUTHORITY_INVALID while visiting a site running Cloudflare indicates the certificate authority that issued the sites SSL certificate is not valid or the site is using self-signed certificate. When this happens, Chrome will display the error NET::ERR_CERT_AUTHORITY_INVALID. [Dedicated SSL] Quick Fix Ideas Contact the sit…

@dohlman

http://thednclan.net

As far for now, at first sight Website is working fine and loading up from by side over HTTPS.

[dohlman]

For me it is not, this is what I see:

I am not making it up you know…

[dohlman]

Also: “http://thednclan.net” is what you used not “https://thednclan.net”.

For the record, I have now waited close to 48 hours so far!!!

DNS names I updated BEFORE adding SSL to the domain names FYI.

Also, I have enabled “Full” encryption on ALL of my domains!

[fritex]

@dohlman

FYI

Thank you for your feedback.

@dohlman

Also: “http://thednclan.net” is what you used not “https://thednclan.net”.

I got redirected from HTTP to HTTPS.

May I ask have you tried:

1. Clearing your Web browser cache?
2. Accessing your Website using a Private Window in your Web browser?
3. Accessing using another Web browser if you have at least two installed on your device?
4. Accessing using a VPN connection?
5. How about restarting your home router?

Kindly, try with this too:

Fix NET::ERR_CERT_AUTHORITY_INVALID Error on Chrome

How to Fix the NET::ERR_CERT_AUTHORITY_INVALID Error

[matteo]

This is going to the origin directly. There is an issue with DNS caching, either locally or at the ISP.

[dohlman]

I am rapidly losing my patience.

You all seem to be desperately trying to make out the problem is my side when it is clearly not.

I have tried all of the suggestions by fritexvz and I am still getting the same problem.

This same problem happens on my laptop, PC and phone when I use my ISP’s internet, when I use my phone net with a different provider, it works fine, but I am unable to get to my emails on my phone though my phone carrier using Aquamail.

I am not going to us a VPN so you can avoid even attempting to resolve this matter.

It may also be worth mentioning that I have a friend in Texas who also tried to access it and got EXACTLY the same problem as I am getting, yout according to CloudFlare, I am a “liar”.

I have another domain attached to my cloudflare accoount and that is set up EXACTLY the same way as the two I am having issues with, yet it works fine!

Not impressed with this deliberate delay!!!

[dohlman]

More deliberate delays!

[cs-cf]

@dohlman

You all seem to be desperately trying to make out the problem is my side when it is clearly not.

No one is desperate to do anything of the sort. You made a DNS query, you get 2 different answers. Off the virgin media network you get the correct answer. on the Virgin media network you get the wrong answer.

Cloudflare’s nameservers are only giving one answer… the IP address of the Cloudflare proxy.

➜  ~ dig  www.thednclan.net @1.1.1.1

; <<>> DiG 9.10.6 <<>> www.thednclan.net @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29700
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.thednclan.net.		IN	A

;; ANSWER SECTION:
www.thednclan.net.	300	IN	A	104.21.76.47
www.thednclan.net.	300	IN	A	172.67.187.175

Since you are getting a different answer from Virgin media which points to your origin server, something else is giving a different/ wrong answer. @matteo and @fritex have both provided logical, consistent and detailed suggestions for the cause and remediation.

You can run the same dig command or an nslookup equivalent to determine what IP address is being returned (it’s your origin IP based on the screenshot). The DNS value being returned is being returned by the DNS server specified in your OS while on that network.

@dohlman

but I am unable to get to my emails on my phone though my phone carrier using Aquamail.

I have no idea what this means. How is it related to the web page not rendering.

@dohlman

It may also be worth mentioning that I have a friend in Texas who also tried to access it and got EXACTLY the same problem as I am getting, yout according to Cloudflare, I am a “liar”.

None of the people replying in this thread work for Cloudflare nor have they called you a liar. Not sure what to tell you beyond the same thing others here have stated, it is likely a DNS caching issue with your provider.

DNS Checker - DNS Check Propagation Tool

@dohlman

Not impressed with this deliberate delay!!!

There is no delay. The answers were provided as to the likely causes. There doesn’t appear to be any evidence that Cloudflare is returning incorrect IP addresses for your origin. Unfortunately Cloudflare doesn’t control the DNS settings of 3rd party DNS resolvers.

[fritex]

@dohlman

I cannot access my emails via email clients such as AquaMail in both instances and I mean both providers

Due to e-mail issue, you have got:

0   _dc-mx.01310ca242ee.thednclan.net   160.153.16.27 
27.16.153.160.in-addr.arpa ->  ip-160-153-16-27.ip.secureserver.net

Obviously, this could mean you have misconfigured e-mail at DNS tab.
Or, the e-mail record like A mail or some other to which the MX record is pointed is being proxied via Cloudflare ( cloud).

• maybe you have a CNAME record for yourdomain.com, and then your e-mail client is actually using yourdomain.com which is cloud

An MX record should point to a subdomain, such as ‘mail’, and the “A” type DNS record for that hostname should be set to DNS Only.
If you have CNAME record, remove it.

Example:

Cloudflare does not proxy e-mail traffic, only web traffic - the same goes for the Cloudflare Origin CA Certificate, if you use it.

Furthermore, to have your e-mail secure, use a valid SSL certificate.

More information how to propperly setup e-mail while using Cloudflare and about e-mail troubleshooting and deliverability issues can be read here:

Deprecated - Email Troubleshooting

This tutorial is deprecated in favour of Troubleshooting email issues · Cloudflare DNS docs

Archive

This tutorial covers the steps you should take if, when you change your domain to point to Cloudflare, you no longer receive emails to your domain. If you follow this tutorial and still need further help, please let us know what you have tried and share your domain name and, if possible, a redacted screenshot of your DNS records in Cloudflare. <a href="https://youtu.be/hLKyUWQcu08">…

https://support.cloudflare.com/hc/en-us/articles/200168876-Email-undeliverable-when-using-Cloudflare

Usefull tips about e-mails to consider:

How to prevent your emails from going to spam

As a website admin, you will likely be sending out emails to your customers or visitors for newsletters, account notifications, product updates, etc. Depending on the circumstances, you might start noticing your emails are ending up in customers’ spam/junk folders instead of their email inbox. This issue can be caused by a few things, and I’ll go into detail for each: Misconfigured DNS/absence of necessary records Poor domain reputation FAQ Misconfigured DNS/absence of necessary records For…

[dohlman]

DNS has updated to CloudFlare servers.

It is just not showing the SSL properly here… How many times do I need to say it?

Virgin Media:
Computer access → “Privacy error”
Mobile phone access → “Privacy error”

EE (Mobile phone network)
Mobile phone access → Working fine.

I updated the email suggestion and it is now working, thanks.

Now I just want my site to load correctly with HTTPS but it wont because something is preventing the SSL certificate I am using being valid aparrently. Thats what I am being told from the screenshots above.

[cs-cf]

@dohlman

It is just not showing the SSL properly here… How many times do I need to say it?

The error you are receiving shows a Cloudflare Origin certificate in the error message. The Cloudflare origin certificate is only present on your origin. It isn’t present on Cloudflare’s edge. The SSL error you are receiving is because your browser is connecting to your origin server’s IP address not the IP address of Cloudflare’s edge server.

@dohlman

Now I just want my site to load correctly with HTTPS but it wont because something is preventing the SSL certificate I am using being valid aparrently.

A Cloudflare origin certificate is intended to be used to secure the connection between Cloudflare’s edge and your origin server. It is signed and trusted by Cloudflare’s network because Cloudflare issued it, but it is not trusted by user’s browsers nor is it intended to be. Users are supposed to hit Cloudflare’s edge server where a valid cert issued by a publicly trusted CA is present and Cloudflare then provides the other services because the record is proxied.

On your machine edit your host file and add an entry for

thednclan.net 104.21.76.47

That is one of the proxy IP addresses. With that hardcoded on your machine you will see the Cloudflare edge certificate is displayed. Until whatever DNS server Virgin Media provides has the correct value the origin IP address it is currently returning will continue to prompt with a certificate error for anyone who gets that value back from them. Cloudflare, nor anyone in the forum can force Virgin Media or whatever upstream server is being used while on their network to update their DNS cache for the entry. Whosever manages that DNS server would need to do it.

[dohlman]

In my DNS records, I have an “A” record that is set to go to the “origin server” but it is proxied.

Does that help you figure out this problem?

[matteo]

The issue is not in the DNS records. It’s in the DNS server used by your ISP. Change it on your device and it will work… We are going in circles here.

[dohlman]

Where is and what is the “host file”?

And we are not going in circles, I am trying to fix this and its NOT working!!!

[matteo]

@dohlman

Where is and what is the “host file”?

It’s a configuration file in the OS, but if you don’t know what that is, it’s better to leave it alone.

@dohlman

I am trying to fix this and its NOT working!!!

You can’t fix it, it’s a caching issue of the A (or NS) entries. It should solve itself once the caches expire. In the mean time, you can use an alternative DNS server on the devices when using the ISP in which it doesn’t work. Unfortunately, if the cache of the entries was particularly long it needs to expire by itself, unless there is a way to force the expiration, which is specific to the actual ISP/service, nothing Cloudflare, nor us can do.

[dohlman]

Are you saying that there is nothing wrong with my configuration?

I mean I have 3 websites currently being accellerated by CloudFlare, 1 works just fine, the other 2 do not.

This is my issue, but the one that works was added to CloudFlare once registered so that may be the reason it worked almost instantly after I added the CloudFlare configuration…

[matteo]

@dohlman

Are you saying that there is nothing wrong with my configuration?

Not right now, exactly. It might have been way too long of a TTL before, but we can’t know unless you run some nslookup/dig commands on the not working ISP.

If they all work using some ISPs, then the config works.

[dohlman]

I know that the DNS records are updated globally…

What can I do to get this working properly?

You have mentioned “TTL” in your previous post, could you suggest how I update that to be faster?