From 8cb09a8fa238325f9d1b7b49c80cd64cda49d58f Mon Sep 17 00:00:00 2001
From: axcelx <jthomas@axcelx.com>
Date: Thu, 29 Jan 2026 17:29:20 -0500
Subject: [PATCH] Update server.j2

Problem
Sites intermittently return HTTP 421 "Misdirected Request" errors after failover/failback events. The error occurs on HTTPS requests and affects all clients.

Root Cause
When nginx proxies HTTPS requests to Apache on port 4430, it does not send the SNI (Server Name Indication) header. Apache has multiple SSL vhosts listening on port 4430 and relies on SNI to determine which vhost should handle the request. Without SNI, Apache cannot match the incoming request to the correct vhost and returns a 421 error.

The error message from nginx logs:
access forbidden by rule, client: x.x.x.x, server: _, request: "HEAD / HTTP/1.1", host: "example.com"

The 421 response includes charset=iso-8859-1 indicating it originates from Apache, not nginx.

Solution
Add the following nginx directives to all SSL server blocks in conf/server.j2:

nginxproxy_ssl_server_name on;
proxy_ssl_name $host;

These directives instruct nginx to:

proxy_ssl_server_name on - Enable passing the SNI header when proxying to upstream SSL servers
proxy_ssl_name $host - Use the requested hostname as the SNI value


Files Changed

conf/server.j2 - Added proxy SSL settings in all 5 SSL server blocks (after ssl_stapling on; directives)

Testing

Before fix: curl -Ik https://example.com returns HTTP 421
After fix: curl -Ik https://example.com returns HTTP 200
---
 conf/server.j2 | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/conf/server.j2 b/conf/server.j2
index f625ac11..046e820a 100644
--- a/conf/server.j2
+++ b/conf/server.j2
@@ -17,6 +17,8 @@ ssl_certificate_key {{ CPANELSSLCRT }};
 {% if OCSPSTAPLE %}
 ssl_stapling on;
 {% endif %}
+proxy_ssl_server_name on;
+proxy_ssl_name $host;
 {% endif %}
 server_name www.{{ MAINDOMAINNAME }};
 
@@ -91,6 +93,8 @@ ssl_certificate_key {{ CPANELSSLCRT }};
 {% if OCSPSTAPLE %}
 ssl_stapling on;
 {% endif %}
+proxy_ssl_server_name on;
+proxy_ssl_name $host;
 {% endif %}
 server_name {{ MAINDOMAINNAME }};
 
@@ -165,6 +169,8 @@ ssl_certificate_key {{ CPANELSSLCRT }};
 {% if OCSPSTAPLE %}
 ssl_stapling on;
 {% endif %}
+proxy_ssl_server_name on;
+proxy_ssl_name $host;
 {% endif %}
 server_name {% for DOMAIN in REDIRECTALIASES_LIST %}{{ DOMAIN+" " }}{% endfor %};
 
@@ -394,6 +400,8 @@ ssl_certificate_key {{ CPANELSSLCRT }};
 {% if OCSPSTAPLE %}
 ssl_stapling on;
 {% endif %}
+proxy_ssl_server_name on;
+proxy_ssl_name $host;
 server_name  {% for DOMAIN in DOMAINLIST %}{{ DOMAIN+" " }}{% endfor %};
 {% if waf == 'enabled' %}
 error_log {{ HOMEDIR }}/logs/nginx_error_log;
@@ -545,6 +553,8 @@ ssl_certificate_key {{ CPANELSSLCRT }};
 {% if OCSPSTAPLE %}
 ssl_stapling on;
 {% endif %}
+proxy_ssl_server_name on;
+proxy_ssl_name $host;
 {% endif %}
 server_name {% for DOMAIN in DOMAINLIST_PROXY_SUBDOMAIN %}{{ "cpanel."+DOMAIN+" " }}{% endfor %} {% for DOMAIN in DOMAINLIST_PROXY_SUBDOMAIN %}{{ "webmail."+DOMAIN+" " }}{% endfor %} {% for DOMAIN in DOMAINLIST_PROXY_SUBDOMAIN %}{{ "whm."+DOMAIN+" " }}{% endfor %} {% for DOMAIN in DOMAINLIST_PROXY_SUBDOMAIN %}{{ "cpcontacts."+DOMAIN+" " }}{% endfor %} {% for DOMAIN in DOMAINLIST %}{{ "cpcalendars."+DOMAIN+" " }}{% endfor %};
 location / {