`This hostname is not covered by a certificate` only on pages CNAMES
See image:
Ddoes not happen for workers, only for pages CNAMEs, and according to the cert manager it should be covered
HIf you visit the domain, does it show a cert?
DDbrowser can't load it from the domain
Dand https://tangialeaderboardfrontend.pages.dev/ shows
Failed to load resource: net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH in the consoleD@HardAtWork so the pages hosting directly seems to be having issues..
HThat one loads fine for me
Dif you check the console it's not
HDI see that too
Doh well it's trying to get from the domain lol yeah
Dhtmx.js:3080 GET https://leaderboard-frontend.cf.tangia.co/root net::ERR_SSL_VERSION_OR_CIPHER_MISMATCHHOh
HHow old is the custom domain?
D8 days
HDid it work before?
DI don't think I ever checked tbh
Dfixing something someone who is offline in germany made and is now away for the weekend lol
HTry deleting the custom domain and then re-adding it
Dok
D@HardAtWork immediately shows it again
HGive it a minute
D@HardAtWork still the same :/
HHm…
DSome more context, we have cf.tangia.co on cloudfalre, not tangia.co
Ddon't think that's an issue as it's clearly not for workers, but some context
Dwe do have a pages site that isn't using the cloudflare DNS that works fine
Dbut anything using the cf subdomain is having issues
Dcould it be because it's proxied?
Dthe error goes away in the dashboard but it's still showing SSL issues on the browser when I turn proxy off
HMight be ACM just broke and got stuck…
DI just tried recreating it again without proxying, no luck
Dgoogle dig is pulling a records too...
Dthat shouldn't happen when it's not being proxied IIUC
DAnd it keeps renewing them? @HardAtWork does that sound right?
Dhappens with proxying or just DNS
Dif I go to add a new one it doesn't even recognize that CF has it like workers does
DHThink it only tries once
DI tried with another subdomain too, still an issue
DI don't think there are any CAA records either that would prevent this, because our workers are fine
CIt might be related, not 100% sure, but if I recall correctly Pages likes to use GTS sometimes, and you're missing the caa for it
C;; ANSWER SECTION:
tangia.co. 60 IN CAA 0 issue "amazon.com"
tangia.co. 60 IN CAA 0 issue "amazonaws.com"
tangia.co. 60 IN CAA 0 issue "amazontrust.com"
tangia.co. 60 IN CAA 0 issue "awstrust.com"
tangia.co. 60 IN CAA 0 issue "globalsign.com"
tangia.co. 60 IN CAA 0 issue "letsencrypt.org"
tangia.co. 60 IN CAA 0 issue "amazon.com"
tangia.co. 60 IN CAA 0 issue "amazonaws.com"
tangia.co. 60 IN CAA 0 issue "amazontrust.com"
tangia.co. 60 IN CAA 0 issue "awstrust.com"
tangia.co. 60 IN CAA 0 issue "globalsign.com"
tangia.co. 60 IN CAA 0 issue "letsencrypt.org"
CWhen setting up your Pages project, you may encounter various errors that prevent you from successfully deploying your site. This guide gives an …
DHuh… so maybe those records were made after the workers cert was provisioned?
CThe workers cert was a Let's encrypt one, which is allowed
DOh lol
CPages may have simply just picked to use GTS and hit a wall
DWhat is gts?
CGoogle Trust Services
