Why are some users getting HTTP 404 errors when accessing content through the CDN?
A 404 (Not Found) error indicates that the requested content was not found on the origin server. The CDN does not generate 404 errors on its own; it only forwards them if the origin responds with this status code.
It’s important to differentiate this from other errors like 502 (Bad Gateway) or 504 (Gateway Timeout), which may occur if the CDN is unable to reach the origin due to connectivity issues.
⚠️ After content is uploaded to the origin, there may be a short delay (up to 1 minute) before the CDN stops returning a cached 404 and begins serving the new content. This ensures efficient caching and protects the origin from excessive requests.
Why are users receiving 502 or 504 errors from the CDN edge?
HTTP 502 (Bad Gateway) and 504 (Gateway Timeout) errors typically indicate that the CDN edge server was unable to establish a successful connection with the origin server. This can happen due to several reasons:
- Misconfiguration of the origin setup or CDN distribution
- Network connectivity issues between the edge server and the origin
- Origin server resource exhaustion, such as high load or timeouts
These errors are not generated by the CDN itself, but are passed through from the origin when it fails to respond properly.
In most case, investigation by Leaseweb support is required. However, before escalating, please provide:
- The output of a
curl
command showing the error
- A HAR file (HTTP Archive) from their browser or application, which can help us reproduce and analyze the issue
This information is essential for diagnosing the root cause efficiently.
Is Gzip compression supported for MPEG-DASH streaming?
Gzip compression is not supported for MPEG-DASH streaming. This is due to limited compatibility—only one of our four CDN providers currently supports Gzip for streaming content. Enabling it could lead to inconsistent behavior across providers, so it is not recommended.
Can I get a list of all CDN subnets or IP addresses?
Some customers request our CDN IP ranges to restrict access to their origin servers and allow only our infrastructure.
- GCore: https://api.gcore.com/cdn/public-ip-list
- Fastly: https://api.fastly.com/public-ip-list
- Cachefly: https://cachefly.cachefly.net/ips/cdn.txt
- CDNetwork: Will be delivered on demand
For Leaseweb infra/shields:
- IPv4:
- 185.28.68.0/24
- 185.28.70.0/24
- IPv6:
- 2a00:9d20:31::/48
- 2a00:9d20:101::/48
Can I use both HTTP and HTTPs connections to origin?
No. For consistency and reliability, each origin must be configured to use either HTTP or HTTPS exclusively. Mixing both protocols for the same origin configuration is not supported and may lead to unpredictable behavior or connectivity issues.
Can I specify a specific PoP (Point of Presence) for my end-users' requests?
No. Our CDN automatically selects the optimal PoP based on the end-user’s location and network conditions to ensure the lowest possible latency. Manually specifying a PoP is not supported, as it would interfere with the performance benefits of dynamic routing.
Is HTTP/2 supported?
Yes. HTTP/2 is supported by default across all of our CDN providers, making it a standard feature of our platform. No additional configuration is required to enable it.
Can I use an object storage origin within an origin group?
Yes, but only if the object storage is configured as a simple origin—meaning it does not require any authentication. Authenticated object storage endpoints are not supported within origin groups.
Why do traffic statistics take a long time to update, or why are yesterday’s statistics still increasing today?
Our Multi-CDN platform is designed to deliver optimal performance by distributing traffic across multiple partner CDNs. As a result, usage data must be collected from each of these partners and then processed before appearing in your dashboard.
This aggregation process can introduce a delay in updating statistics, particularly when there are interoperability issues or delays on the provider side. While we strive to minimize this delay, it may occasionally take longer than expected. In such cases, the data will continue to update incrementally as we catch up with the latest metrics.
I updated the SSL certificate on my distribution, but the CDN is still serving the old one. Why?
When an SSL certificate is updated on a CDN distribution, it can take several minutes for the new certificate to propagate across all CDN nodes globally. During this time, some end users may still see the old certificate due to propagation delay or local DNS/SSL caching.
If the new certificate has not taken effect after more than an hour, it’s likely that there is an issue preventing proper propagation. In such cases, please contact support — the issue may require investigation by Leaseweb support to resolve.
To assist with troubleshooting, please ensure you’ve cleared local caches and verified the certificate using tools like openssl
or SSL checking services.
I can't create or delete CDN resources (distribution, origin, or certificate), or my distribution is stuck in a "Pending" state. What should I do?
These cases should be communicated with the Leaseweb support team with the details below which will help us resolve the issue as quickly as possible:
- A description of the issue and how we can reproduce it
- The name or ID of the distribution, origin, or certificate involved
- The approximate time when you first noticed the issue
Why is my origin experiencing a high load?
A high load on your origin is often related to caching configuration, particularly the Time-To-Live (TTL) settings. If the CDN is not caching content effectively, it will forward more requests to your origin, increasing its load.
To reduce the load on your origin, we recommend:
- Increasing the Default TTL value to allow the CDN to cache content for a longer period
- Disabling the Origin Controlled option, so the CDN doesn’t override your settings with those returned by your origin
These adjustments help ensure that more traffic is served directly from the CDN cache rather than your origin.
Why am I seeing traffic served only by one CDN provider?
There are a few possible reasons why your traffic may appear to be routed through only one CDN provider:
- Performance-based routing: Our system continuously monitors the performance of all integrated CDN providers. If one provider is underperforming, DNS routing logic may temporarily switch all traffic to the faster provider to ensure optimal end-user experience.
- Regional DNS routing logic: In some regions, the DNS logic may favor a specific provider based on factors such as coverage, latency, or availability. This can result in a single provider serving traffic for users in that area.
This behavior is expected and part of our optimization strategy to ensure reliable and fast content delivery.
How can we use an object storage as the origin on Multi-CDN distributions?
Using an object storage as the origin for your Multi-CDN distribution is possible through simple origins.
- Add your bucket URL in the host field.
- If you have authentication on your bucket select AWS Signature V4 in the Authentication Method field. Fill all of the fields that appear after selecting it.
For more details: Simple Origin
How to update SSL certificate using API?
The API endpoints which allow management of the SSL certificates are described in the following URL: https://developer.leaseweb.com/docs/#tag/CDN The procedure for updating an SSL certificate using the API is similar to how it’s done on the dashboard:
- Create (upload) the new certificate.
- Update all distribution groups that use the existing certificate to use the new one.
- Wait until the CDN starts serving the new certificate for the above distribution groups. Usually this takes a few minutes for all CDNs to be updated.
- Delete the old certificate.
How can I get 95th percentile statistics?
The CDN dashboard does not currently offer 95th percentile statistics. However, you can still extract this information using the CDN API.
How can I use wildcard invalidation?
A wildcard invalidation is a common approach when a customer is updating several contents in the same directory. To do a wildcard invalidation for Multi-CDN in the CDN Portal the customer can add the wildcard symbol (\*) after their URL+ path. Here are some examples:
- https://di-XXXXXXXXX.leasewebultracdn.com/test_dir/* -> This will invalidate everything inside `/test_dir/` directory
- https://di-XXXXXXXXX.leasewebultracdn.com/test_dir/1/* -> This will invalidate everything inside `/test_dir/1` directory
⚠️ Warning
Wildcard invalidations are not supported on the Shield distributions.
How to configure GEO and IP subnet targeting/blocking or Referrer blocking?
You can find the details of GEO targeting/blocking or IP subnet targeting/blocking or Referrer blocking in the Security Settings section of Multi-CDN Knowledge Base. After filling in all the relevant fields in that specific distribution you want to apply the targeting/blocking, save your changes by clicking on Save.
How to enable CORS / XMLHttpRequest on the CDN?
In order to setup a proper CORS policy to support XMLHttpRequest to the origin, the HTTP response header Access-Control-Allow-Origin needs to be set, as described here: Mozilla CORS specification
For cache efficiency reasons, our CDN discards this header by default.
If your origin is already producing this header (recommended), add the header name in the Passthrough headers of your distribution, as described below:
- Edit the Distribution.
- Scroll down to Passthrough Header Section.
- Click on the + Add More Passthrough Headers button.
- Type-in the header name Access-Control-Allow-Origin in the text field that appears.
- Click Save button to save the Distribution.
If however your origin is not producing the CORS headers, you can configure the CDN to do it instead:
- Edit the Distribution.
- Scroll down to Static Header Section.
- Click on the + Add Static Header button.
- Type-in the header name Access-Control-Allow-Origin and the header value (as described in the Mozilla CORS specification) in the text fields that appear.
- Click Save to save the Distribution.
How to configure the delivery of live stream?
Selecting the correct cache settings plays a key role while delivering live streams. Short-term cache settings for adaptive live streaming is recommended. Streaming protocols typically consist of two main types of files:
- Media segment files (e.g., .ts, .m4s, .mp4): These contain small chunks of video or audio data.
- Playlist or manifest files (e.g., .m3u8, .mpd, .ism/Manifest): These describe how the stream is organized and list the sequence of segments to be played.
When a user starts playback, their player first requests a manifest file to understand the available segments and playback options. Then, it fetches the segment files listed in the manifest to begin streaming.
In live streams, video manifests are periodically refreshed when new segments become available, specially for HLS. We recommend setting manifest file TTLs to less than half of the video segment duration, typically 1-2 seconds for 5-second video segments. Caching segments too briefly may lead to 404 errors if the manifest references segments that have already expired in cache.
You can adjust your cache settings as explained in Cache Settings.
⚠️ Warning
Using shield-distributions is not recommended, because they add another caching layer, which increases the latency and the lower TTLs of chunks and playlists will start expiring. It’s recommended to enable Origin Controlled Delivery Cache.
How to configure the delivery of VoD (Video on Demand) stream?
Video files are generally large in size, so using a longer TTL is recommended to reduce unnecessary origin requests. Shield distributions can also be utilized if desired, as the extended TTL ensures that files are cached longer and do not need to be re-uploaded frequently.
You can adjust your cache settings as explained in Cache Settings.
Why is my content not being cached properly when using the "Origin Control" option?
This issue can occur due to the specific setup of your origin. Here are the most common causes:
- S3 Object Storage as Origin: If your origin is an S3 object storage bucket, the default behavior may return cache-control headers such as max-age=0, which instructs the CDN not to cache the content. In such cases, we recommend disabling the “Origin Control” option and manually setting the desired TTL (Time To Live) via the CDN configuration.
- Custom S3 Proxy Setup with Shield Distributions: If you are using a custom setup that includes our Shield CDN in combination with an S3 proxy, the behavior may also result in no effective caching. You can identify this setup if:
- Your distribution uses a Shield CDN.
- The origin behind the shield is an advanced origin.
- The advanced origin is configured with `127.0.0.1` or localhost and uses port `8097`.
This setup indicates the use of an S3 proxy. In such configurations, we also advise disabling the “Origin Control” option and manually configuring the TTL settings.
By adjusting your cache settings as described, you can ensure that your content is cached effectively across the CDN network.
Why am I seeing requests coming in on multiple domains?
This typically happens when your CDN distribution is configured with multiple domains under the “Domain(s)” section. It’s a common and valid setup—especially for users who serve content through several custom domains or subdomains. If you are seeing traffic across different domains and would prefer to limit this:
- You can review and manage your domain list by going to the Distribution Settings > Domain(s).
- Simply remove any domains you no longer wish to serve content through.
This will ensure that your distribution only responds to requests made to the specified domains you’ve retained.
There’s no issue with having multiple domains configured, but cleaning up unused or unnecessary entries can help simplify monitoring and reporting.
Why do I see unusual response headers?
These headers are automatically added by our CDN providers as part of their internal request tracking and routing mechanisms. Examples include:
“`
x-id-fe: fr5-hw-edge-gc62
x-id: fr5-hw-edge-gc15
x-llid: bbfd8235bc828032a0b8e444c6e17a22
“`
These headers:
- Are harmless and informational
- Do not impact the functionality, performance, or security of your service
- Cannot be removed, as they are part of our providers’ infrastructure
You can safely ignore these headers—they are intended for diagnostic and support purposes by the CDN network.
Why are changes to my distribution not taking effect?
Changes to a distribution can take up to 30 minutes to fully propagate across all CDN providers. This is a normal behavior due to the distributed nature of CDN infrastructure.
Additionally, if you have modified TTL settings or updated the content on your origin, it is recommended to perform a full invalidation of the distribution. This ensures that stale content is removed from the cache and new settings take effect properly.
If the issue persists beyond the expected propagation time, please contact support for further assistance.