On April 8, 2026, Dixa experienced a partial outage lasting approximately 58 minutes. New WebSocket connections were unable to be established, which meant that new logins failed, and any agents who refreshed their browser or lost their connection could not reconnect. Agents who remained on an existing session were unaffected during the incident.
The root cause was a TLS certificate misconfiguration introduced during a planned migration of our ingress controller infrastructure. The issue was identified, fixed, and fully resolved within the hour.
Between 18:26 and 19:24 CEST, customers attempting to log in to Dixa or re-establish a WebSocket connection (e.g., after a page reload) were unable to do so. Browsers rejected the connection due to an invalid TLS certificate being served.
Agents who were already logged in with an active WebSocket session continued to operate normally throughout the incident. The impact was limited to new or reconnecting sessions.
A small number of customers were affected and reported the issue to our support team.
No conversations or data have been lost during the incident.
ERR_CERT_AUTHORITY_INVALID)As part of our ongoing WebSocket resilience work to ensure a more stable platform, we migrated our ingress controller (the component that routes incoming traffic to internal services) from an end-of-support solution to a new one. This migration was tested in our staging environment before being applied to production.
However, there was a configuration discrepancy between staging and production for the ingress class that handles WebSocket traffic. When DNS was switched to the new ingress controller on the morning of April 8, existing connections continued to work through cached DNS entries still pointing to the old controller. Hours later, as DNS caches expired across the internet, clients began resolving to the new controller, which, due to the misconfiguration, did not recognize the WebSocket routes. This caused it to serve a default self-signed TLS certificate instead of the valid one, leading browsers to reject the connection.
The length of the partial outage per customer varies depending on when the DNS cache expired, and if WebSocket connections started to connect to the new load balancer.
Once the root cause was identified, a configuration update was deployed to the new ingress controller so that it could correctly handle WebSocket traffic. Connections began recovering immediately after the fix was applied.
We have taken the following steps to reduce the likelihood and impact of similar issues in the future:
We sincerely apologize for the disruption this caused. Reliability is a top priority for us, and we are committed to learning from every incident to make Dixa more resilient. If you have any questions, please don't hesitate to reach out to your account team or our support at friends@dixa.com.