421 Misdirected Request
The request reached a server that cannot answer for this hostname
Seen in Browsers, Apache, nginx, CDNs (HTTP/2)
The server is not configured to answer for the hostname on this connection, usually after HTTP/2 reused a connection opened for another name.
Common causes
- HTTP/2 connection reuse: a certificate covers several hostnames, but they are served by different servers or virtual hosts.
- The TLS SNI name differs from the Host header, which Apache rejects with 421.
- A reverse proxy connecting to an HTTPS upstream without sending SNI.
How to fix it
- Serve every hostname on a shared certificate from the same server, or use separate certificates per server.
- Make sure clients and proxies send the same name in SNI and Host.
- In nginx proxying to HTTPS, set proxy_ssl_server_name on;
Got a different message? Paste it into the error explainer.
Related errors
- Error 525: SSL handshake failed · Cloudflare could not complete TLS with your origin
- Error 526: Invalid SSL certificate · Cloudflare doesn't trust your origin's certificate
- 502 ERROR The request could not be satisfied. CloudFront wasn't able to connect to the origin. · CloudFront could not get a valid response from the origin
- 502 Bad Gateway · The proxy got a bad response from the server behind it
- 503 Service Unavailable · The server is temporarily unable to handle requests
- 504 Gateway Timeout · The server behind the proxy took too long
- Error 520: Web server is returning an unknown error · Cloudflare got an empty or invalid response
- Error 521: Web server is down · Cloudflare could not connect to your origin
- Error 522: Connection timed out · Cloudflare timed out connecting to your origin
- 429 Too Many Requests · You've hit a rate limit
- 400 Bad Request · The server could not understand the request
- 401 Unauthorized · The request needs valid credentials