CD
Cloudflare Developers•16mo ago
Lucas

Error configuring Cloudflare Pages custom domain

I set up a custom domain on Cloudflare Pages, but when I access the address, an ERR_SSL_VERSION_OR_CIPHER_MISMATCH error is returned. The pages.dev address works, but the domain does not. https://redelimpanome-parceiros-app.pages.dev https://parceiro.redelimpanome.com.br
15 Replies
Soham
Soham•16mo ago
heh, cloudflare is marking it as malware for me try set the ssl to full(strict) in the domain settings
Lucas
LucasOP•16mo ago
@Soham my domain is not hosted on Cloudflare. How do I do that?
Cyb3r-Jak3
Cyb3r-Jak3•16mo ago
It can take some time for the SSL certificate to be provisioned for a custom domain. Does it show as active?
Lucas
LucasOP•16mo ago
@Cyb3r-Jok3, it's been two days and nothing. Shows Inactive (Requires DNS setup)
Soham
Soham•16mo ago
where is your domain hosted on?
Lucas
LucasOP•16mo ago
Hostinger
Soham
Soham•16mo ago
are your nameservers on cloudflare?
Lucas
LucasOP•16mo ago
The domain is in the name of a client. But I believe it's on Hostinger too.
Soham
Soham•16mo ago
did you add the dns record for the website?
Lucas
LucasOP•16mo ago
Yes. If I run nslookup parceiro.redelimpanome.com.br 1.1.1.1 I have the following output: 
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
parceiro.redelimpanome.com.br   canonical name = redelimpanome-parceiros-app.pages.dev.
Name:   redelimpanome-parceiros-app.pages.dev
Address: 172.66.44.155
Name:   redelimpanome-parceiros-app.pages.dev
Address: 172.66.47.101
Name:   redelimpanome-parceiros-app.pages.dev
Address: 2606:4700:310c::ac42:2c9b
Name:   redelimpanome-parceiros-app.pages.dev
Address: 2606:4700:310c::ac42:2f65
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
parceiro.redelimpanome.com.br   canonical name = redelimpanome-parceiros-app.pages.dev.
Name:   redelimpanome-parceiros-app.pages.dev
Address: 172.66.44.155
Name:   redelimpanome-parceiros-app.pages.dev
Address: 172.66.47.101
Name:   redelimpanome-parceiros-app.pages.dev
Address: 2606:4700:310c::ac42:2c9b
Name:   redelimpanome-parceiros-app.pages.dev
Address: 2606:4700:310c::ac42:2f65
Could it be something in the SSL configuration where the domain is hosted?
Soham
Soham•16mo ago
yeah probably
Chaika
Chaika•16mo ago
You have CAA records created for your domain: 
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;redelimpanome.com.br.          IN      CAA

;; ANSWER SECTION:
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "letsencrypt.org"
redelimpanome.com.br.   14400   IN      CAA     0 issue "digicert.com"
redelimpanome.com.br.   14400   IN      CAA     0 issue "letsencrypt.org"
redelimpanome.com.br.   14400   IN      CAA     0 issue "comodoca.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "digicert.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "comodoca.com"
redelimpanome.com.br.   14400   IN      CAA     0 issue "globalsign.com"
redelimpanome.com.br.   14400   IN      CAA     0 issue "sectigo.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "sectigo.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "globalsign.com"
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;redelimpanome.com.br.          IN      CAA

;; ANSWER SECTION:
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "letsencrypt.org"
redelimpanome.com.br.   14400   IN      CAA     0 issue "digicert.com"
redelimpanome.com.br.   14400   IN      CAA     0 issue "letsencrypt.org"
redelimpanome.com.br.   14400   IN      CAA     0 issue "comodoca.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "digicert.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "comodoca.com"
redelimpanome.com.br.   14400   IN      CAA     0 issue "globalsign.com"
redelimpanome.com.br.   14400   IN      CAA     0 issue "sectigo.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "sectigo.com"
redelimpanome.com.br.   14400   IN      CAA     0 issuewild "globalsign.com"
but you're missing pki.google, which Pages will use (Pages will randomly pick Let's Encrypt or Google) 
example.com.            300     IN      CAA     0 issue "pki.goog; cansignhttpexchanges=yes"
example.com.            300     IN      CAA     0 issuewild "pki.goog; cansignhttpexchanges=yes"
example.com.            300     IN      CAA     0 issue "pki.goog; cansignhttpexchanges=yes"
example.com.            300     IN      CAA     0 issuewild "pki.goog; cansignhttpexchanges=yes"
https://developers.cloudflare.com/pages/platform/debugging-pages/#missing-caa-records
Lucas
LucasOP•16mo ago
@Chaika are they simple DNS records that I can add to the hosting provider? Another thing: I created another application on the same domain, but with a different subdomain and it worked normally. admin.redelimpanome.com.br
Chaika
Chaika•16mo ago
are they simple DNS records that I can add to the hosting provider?
Yup
admin.redelimpanome.com.br
If you click on cert details, you can see it's a Let's Encrypt cert. You just got lucky, is all. Pages will use either Google or Let's Encrypt, it just picked Google for the other one and failed, is likely what happened
Lucas
LucasOP•16mo ago
@Chaika Thanks. I'll try to add them and test again. @Chaika , thanks. I added the records and it worked

Did you find this page helpful?