Resolving ipv6 when using ipv4 as OWNED + SSL certificate

S

seansan

New member
Joined
Nov 30, 2014
Messages
2
Hi, maybe someone can help me out. I haven't seen any help articles about our issue (maybe unique to us, maybe more general - and good if something is written about it)

We installed an SSL certificate (multi domain)
For this we need to set the ipv4 to OWNED to a account
We always also had an ipv6 IP linked to that reseller/account
Only now I see this IPv6 IP is SHARED .. (should this also be OWNED?)

But here comes our problem. More recently we noticed that all scripts that are run locally and have to grab a file from our server via http are now in error. They seem to resolve to both ipv4 and ipv6: but then the actual http request is doen through the ipv6: and then it errors ... 404 not found (let me confirm the file does exist and is reachable through any other browser)

How can this be?

[root@server ~]# wget domain1.com/robots.txt
--2014-11-30 09:43:18-- http://domain1.com/robots.txt
Resolving domain1.com... 2a02:x:x:::1, x.x.x.x
Connecting to domain1.com|2a02:x:x:::1|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2014-11-30 09:43:18 ERROR 404: Not Found.
 
I recall replying to this email this morning, but for anyone who is interested, the scenario is that the domain is assigned to both a shared IP (IPv6) and to an owned IP (IPv4).
For SSL, the shared IP would use the "shared server certificate" at /etc/httpd/conf/ssl.crt/server.crt, while the owned IP uses it's own.
Since the domain resolves to 2 different IPs you'll get random results for the SSL connection.
Solution was to simply remove the IPv6 IPs from the dns zone, or unlink the shared IP from the owned IP, so that only the owned IP is used.

Related:
http://help.directadmin.com/item.php?id=89

John
 
John, most of us can get unlimited IPv6 IP#s.

So with that tought in mind, is it just too complex to allow all sites, whether on shared or owned IP#s, to also get a dedicated IPv6 IP#?

Jeff
 
IPv6's have the same functionality that IPv4 IPs have, as far as DA is concerned.
You can assign them to domains in the same way, etc..

But regardless of IPv6 vs IPv4, I'm not sure why you'd want to have both a shared and owned IP assigned to a domain, (assuming you're using SSL) as it would likely cause SSL certificate issues if the browser ends up flipping between them.

I'm not quite sure where all countries are at, but using just an owned IPv6 for a domain might not be visible to networks that don't yet support them.
For example, up here in Canada, I still cannot connect to an IPv6 address (boo). If you run a domain on IPv6 only, I cannot see it.

John
 
I think that qualifie as 'just too complicated'. But I wasn't thinking about allowing SSL unless both IPv6 and IPv4 IP#s were both Dedicated.

Jeff
 
You must log in or register to reply here.
Back
Top