2 months ago
Domain: mahjmuddle.com. DNS at Porkbun, no Cloudflare in front, CNAME to Railway. Project "mahj muddle", service mahjmuddle, region EU West.
Several visitors in one town (Ruston, Louisiana) get ERR_SSL_PROTOCOL_ERROR - "mahjmuddle.com sent an invalid response" - on their home WiFi. The same people load the site fine on cellular. This affected several users at the start of the season and again yesterday. No other sites are affected for them.
Two questions:
Is HTTP/3 / QUIC enabled on Railway's edge for custom domains, and can it be disabled for my domain? Cloudflare's docs list QUIC over UDP as a cause of intermittent SSL protocol errors on networks that mishandle UDP port 443.
What minimum TLS version does the edge enforce for custom domains? If it is 1.3, router-level SSL inspection devices that do not support 1.3 would fail exactly this way.
4 Replies
2 months ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 2 months ago
2 months ago
I'm able to access the site just fine. Try using a VPN. It's possible that your ISP may be interfering with traffic to your domain.
You can also try proxying your URL behind Cloudflare (though you'll need to migrate to Cloudflare's DNS: https://developers.cloudflare.com/dns/zone-setups/full-setup/)
Attachments
2 months ago
Railway's current networking specs actually answer both questions. The edge supports HTTP/1.1 and HTTP/2, not HTTP/3, so QUIC/UDP 443 shouldn't be involved here. TLS 1.2 and 1.3 are both supported and the minimum is TLS 1.2, so Railway isn't forcing TLS 1.3 either.
That makes this look much more like something specific to that ISP/home network rather than a Railway setting. Since the same users work on cellular, I'd test one affected connection with a VPN and also compare DNS resolution from home WiFi vs cellular. If VPN fixes it, putting Cloudflare in front is probably the practical workaround.
So I wouldn't spend time trying to disable QUIC or lower Railway's TLS minimum — neither seems to match the current Railway edge configuration.
2 months ago
Thanks for the responses... this ISP is doing some sort of filtering on the domain, which would still be an issue with Clloudfare I believe. I'm in contact with them.
cramsey99
Thanks for the responses... this ISP is doing some sort of filtering on the domain, which would still be an issue with Clloudfare I believe. I'm in contact with them.
a month ago
One quick test that may help narrow this down before the ISP replies: compare the DNS result on the affected WiFi with a public resolver like 1.1.1.1 or 8.8.8.8. If the IPs differ, this may simply be DNS filtering! If DNS looks normal, curl/resolve is useful because it bypasses DNS but still sends the real hostname/SNI:
curl -Iv --resolve mahjmuddle.com:443:IP_ADDRESS https://mahjmuddle.com/
If that still fails only on the affected ISP, that points much more toward SNI/TLS filtering than DNS..