Blog | G5 Cyber Security

DNS Change & SSL Errors: What You Need To Know

G5 Cyber Security

TL;DR

Yes, a DNS route change can cause an SSL certificate error. This happens because the certificate is tied to a specific domain name (and sometimes IP address). If your DNS changes point that domain name to a new server with a different certificate, or if the old certificate hasn’t been updated on the new server, browsers will report an error.

Understanding the Problem

Here’s how it works:

When you change DNS records, you’re telling browsers to go to a different server. If that new server doesn’t have a valid certificate for the domain name they’re trying to reach, you get an error.

How a DNS Change Causes SSL Errors

  1. Incorrect DNS Propagation: After changing your DNS records, it takes time (up to 48 hours, but usually much less) for the changes to spread across the internet. During this propagation period, some users might still be directed to the old server while others are sent to the new one. If the old and new servers have different certificates, you’ll see inconsistent results.
  2. Missing Certificate: The most common cause is simply that the new server doesn’t have an SSL certificate installed for the domain name.
  3. Incorrect Certificate Configuration: Even if a certificate is installed, it might not be configured correctly on the web server (e.g., wrong domain names listed in the certificate).
  4. IP Address Mismatch: While less common now with SNI (Server Name Indication), older certificates were sometimes tied to specific IP addresses. If your DNS change moves you to a new IP address, and the certificate isn’t valid for that IP, errors can occur.

Troubleshooting Steps

  1. Check DNS Propagation: Use an online tool like What’s My DNS to see if your new DNS records have propagated globally. Enter your domain name and select the record type (A, CNAME, etc.).
  2. Verify Certificate Installation: Use an SSL checker tool like SSL Shopper to confirm that a valid certificate is installed on your new server for the correct domain name(s).
  3. Check Web Server Configuration: The steps vary depending on your web server (Apache, Nginx, IIS, etc.). Here are some examples:
    • Apache: Check your virtual host configuration file. Ensure the ServerName directive is correct and that you have a valid SSLCertificateFile and SSLCertificateKeyFile pointing to your certificate and key. 
      
<VirtualHost *:443>
    ServerName www.example.com
    DocumentRoot /var/www/html
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/example.com.key
</VirtualHost>
    • Nginx: Check your server block configuration file. Ensure the server_name directive is correct and that you have valid ssl_certificate and ssl_certificate_key directives. 
      
server {
    listen 443 ssl;
    server_name www.example.com;
    root /var/www/html;
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
}
    • IIS: Use the IIS Manager to check the certificate binding for your website. Make sure the correct certificate is selected and that the hostname matches your domain name.
  4. Clear Browser Cache: Sometimes, browsers cache old SSL information. Clear your browser’s cache and cookies, or try a different browser.
  5. Check for Mixed Content: If only some parts of your website are loading over HTTPS, you might have mixed content issues. This can cause warnings even with a valid certificate. Use your browser’s developer tools to identify any insecure (HTTP) resources.

    Press F12 in most browsers and look at the ‘Console’ tab for errors.

Preventing SSL Errors After DNS Changes

Exit mobile version