Resolved Apple devices loading default certificate instead of domain-specific one

[Oldiesmann]

Over the past week or so, I've been getting reports from users on one of my forums that they are no longer able to access the site from their iPads.

Tonight with the help of a friend, we were finally able to track down the issue - iOS is trying to load the default security certificate rather than the one associated with the site itself, and then refusing to load the site since the security certificate was issued for the server's hostname, which is different than the domain this site is hosted on.

Given that this is only happening with iOS devices and I haven't changed anything with regards to the security certificates on the server, I'm guessing that it's an iOS issue, but I was wondering if anyone else is having this problem or if there's anything I can do to get around it.

If it makes any difference, Plesk is set to redirect from http to https automatically and all domains are secured with a free Let's Encrypt certificate (the default one is also a Let's Encrypt certificate, from the server pool).

 

[Oldiesmann]

Managed to get to the bottom of the problem it seems. I have nginx set up as a reverse proxy with Apache and recently enabled http2. Apparently this is causing nginx to send an upgrade header, which in turn causes problems for Safari/iOS. Adding "proxy-hide-header: upgrade;" to the nginx configuration fixed the issue.