Using SSL correctly with a CDN or reverse proxy

Using SSL correctly with a CDN or reverse proxy is a practical Spark Rack customer guide about certificates, HTTPS, validation, redirects, browser trust, and renewal. It is written for readers who may not administer servers every day, but who still need enough detail to understand what a setting or error means, make a safe change, verify the result, and know when the problem must be escalated.

Use the exact values displayed for the selected account, domain, mailbox, database, or hosting service. Hostnames, usernames, ports, paths, limits, and available controls can differ by product. Never substitute a value copied from another service merely because the labels look similar.

What you are trying to accomplish

The objective is to reach a verified end-to-end result without weakening account security or disturbing unrelated services. Before changing anything, identify the exact source, destination, hostname, account, path, domain, or application involved and record the current state.

Start with the correct service and evidence

In ECP, begin in Services, Websites, SSL, DNS, application URLs, and redirect settings. Record the current value before changing it. A useful troubleshooting record separates what is known from what is assumed and preserves the exact timestamp of every test.

Procedure

1. Check the exact hostname shown in the browser warning.
2. Inspect certificate names, issuer, validity dates, and chain.
3. Verify DNS points to the server or proxy that actually presents the certificate.
4. Test redirects and application URLs in a private browser session.
5. Make the smallest change that can produce the intended result.
6. Wait for the ECP save, provisioning action, transfer, synchronization, or queue to finish.
7. Retest from outside the editing session.
8. Compare the result with the written success criteria.
9. Roll back promptly when the change created a new failure and the previous state is known.
10. Document the final value and remove temporary access or test data.

Decision points

Common mistakes

• Working on a similarly named service, domain, mailbox, or database.
• Copying a hostname or username from an old screenshot.
• Testing through a cache, proxy, VPN, saved client credential, or authenticated session.
• Assuming that every service exposes the same control.
• Skipping a backup because the change appears small.
• Leaving a temporary redirect, broad permission, test mailbox, or duplicate record in production.

Acceptance checklist

• The intended user can complete the intended task.
• The result remains correct after a new session or independent test.
• Unrelated websites, mailboxes, domains, and applications still work.
• Renewal, billing, contact, security, and notification settings remain correct.
• The previous state and rollback information are retained until stability is proven.
• Temporary access and test artifacts have been removed.

When to contact Spark Rack

Contact support when a provider-managed action fails, a required control is missing despite correct permissions and service status, protected logs or restoration work are required, or the result remains inconsistent after a controlled rollback and independent test. Include the exact item, desired result, current result, timestamp, safe evidence, and completed steps.

Reference checklist

• Check the exact hostname shown in the browser warning.
• Inspect certificate names, issuer, validity dates, and chain.
• Verify DNS points to the server or proxy that actually presents the certificate.
• Test redirects and application URLs in a private browser session.
• Also consider whether DNS points to a different endpoint.
• Also consider whether the certificate does not include the requested hostname.
• Also consider whether the chain is incomplete.

Security and change-control notes

Use a unique credential for each service identity, store it in an approved password manager, and remove access when a person or vendor no longer needs it. Before editing production data or configuration, keep a restorable copy and a record of the original value. Do not expose passwords, private keys, payment data, recovery codes, or full database contents in screenshots or normal support messages.

After the task is complete, verify renewal dates, notification recipients, and dependent services. Many recurring problems are caused by a technically correct change that was never updated in a second client, application configuration file, DNS provider, forwarding rule, scheduled task, or external integration.

Extended diagnostic sequence

1. Confirm scope: one user, one device, one network, one domain, one mailbox, one database, one service, or all customers.
2. Record the last known-good time and every relevant change after it.
3. Check account and service lifecycle status, billing status, permissions, and notices.
4. Test the most direct supported connection without optional plugins, proxies, caches, or integrations.
5. Compare the working and failing paths one variable at a time.
6. Preserve exact logs and responses before clearing caches or resetting credentials.
7. Restore the last known-good value when the failure began immediately after a reversible change.
8. Retest from an independent client or network and observe for delayed processing.
9. Document the final cause and remove temporary workarounds.