HTTP 421 Misdirected Request

HTTP 421 is Misdirected Request: the request reached a server that can’t or won’t produce an authoritative response for its URI (RFC 9110 section 15.5.20). Either the server isn’t configured for that origin, or the request doesn’t match the connection it arrived on, usually because the client reused a TLS connection for another hostname. The client may retry on a different connection, whether or not the method is idempotent, and a proxy must never generate a 421.

Connection coalescing

HTTP/2 lets a client send requests for several hostnames over one connection, as long as the server’s certificate is valid for each of them (RFC 9113 section 9.1.1). Browsers also want the new hostname to resolve to the connection’s IP address. That saves handshakes, and it’s where 421 comes from:

1. The browser opens a TLS connection for a.example.com; the certificate covers *.example.com.
2. b.example.com resolves to the same IP, so the browser sends b's requests on that connection.
3. The server picked its configuration from the TLS name, a.example.com, and can't serve b there.
4. The right answer is 421, and the browser retries b on a connection of its own.

RFC 9113 names 421 as the way for a server to refuse that reuse.

Who sends it

• nginx answers 421 when a request’s Host differs from the TLS SNI name and the server block for that host has ssl_verify_client on. The error log says client attempted to request the server name different from the one that was negotiated.
• Apache httpd’s mod_ssl answers 421 when a request names a virtual host whose TLS settings differ from those of the host the handshake selected. A reverse proxy that connects to Apache over TLS without sending SNI runs into it.

What clients do

Chrome retries once with connection pooling and alternative services turned off; Firefox retries once on a new connection. Neither retries a streamed upload it can’t replay. So users rarely see one; a 421 in your logs points at a mismatch between certificates, SNI and virtual hosts.

Fixes

• Give hostnames served by different configurations their own certificates, or make every server that presents a shared certificate able to answer for all the names on it.
• Behind a proxy, send SNI to the upstream. nginx doesn’t by default:

location / {
    proxy_pass https://backend.internal;
    proxy_set_header Host $host;
    proxy_ssl_server_name on;      # off by default: no SNI to the upstream
    proxy_ssl_name $host;          # the name to send; defaults to the proxy_pass host
}

• In your own HTTP/2 client, treat a 421 as “open a new connection to this origin and retry once”.

Caching

RFC 7540, where 421 first appeared, made it cacheable by default. RFC 9110, which defines it now, doesn’t list it as heuristically cacheable, so it isn’t.

Search 421 404 in the tool below to compare it with Not Found, the answer for a host the server does serve.