Automattic / Automattic/simplenote-electron

Simplenote fails to sync through proxy using custom SSL certificate

Open
#3,333 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
5.3k
Forks
588
Avg merge
9h 45m
Merged PRs (30d)
4

Description

At work we must use a system-wide proxy for security scanning. This proxy is a MITM, supplying its own certificate.

With the proxy enabled other apps work OK, and the Simplenote web app works, but the Simplenote Linux app cannot sync. Based on the `cert_issuer_source_aia.cc` in the stack trace (see below) it looks like the system CAs are not being used.

If I disable the proxy then Simplenote works as expected.

The proxy is configured through Ubuntu's Settings->Network->Proxy UI.

### Expected
Notes sync

### Observed
Notes permanently have the syncing spinner displayed and don't sync to the server.

```
$ simplenote --trace-warnings
Checking for beta autoupdate feature for deb/rpm distributions
Found package-type: deb
Error: unrecognized flag --no-expose-wasm
Try --help for options
[654415:0902/111414.870213:ERROR:cert_issuer_source_aia.cc(136)] AiaRequest::OnFetchCompleted got error -301
[654415:0902/111416.678551:ERROR:cert_issuer_source_aia.cc(136)] AiaRequest::OnFetchCompleted got error -301
(node:654415) UnhandledPromiseRejectionWarning: Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at ManualUpdater.emit (node:events:507:17)
at ManualUpdater.ping (/opt/Simplenote/resources/app.asar/desktop/updater/manual-updater/index.js:82:12)
at emitUnhandledRejectionWarning (node:internal/process/promises:298:15)
at warnWithErrorCodeUnhandledRejectionsMode (node:internal/process/promises:406:5)
at processPromiseRejections (node:internal/process/promises:470:17)
at process.processTicksAndRejections (node:internal/process/task_queues:96:32)
(node:654415) Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at ManualUpdater.emit (node:events:507:17)
at ManualUpdater.ping (/opt/Simplenote/resources/app.asar/desktop/updater/manual-updater/index.js:82:12)
```

Also in journalctl I see lines like the following every few minutes

```
...
Sep 02 10:48:35 FWTP5313 simplenote.desktop[289829]: [289829:0902/104835.677932:ERROR:cert_issuer_source_aia.cc(136)] AiaRequest::OnFetchCompleted got error -301
Sep 02 10:48:35 FWTP5313 simplenote.desktop[289889]: [289889:0902/104835.678327:ERROR:ssl_client_socket_impl.cc(876)] handshake failed; returned -1, SSL error code 1, net_error -202
...
```
### Where did you see the bug

- System Make: HP
- System Model: Zbook
- OS: Ubuntu
- OS version: 24.04
- Browser (if applicable): NA (Linux app)
- Browser version (if applicable): NA
- Simplenote app version: 2.23.2

Contributor guide

Open the contributing guide

Research direction

Reproduce the sync failure with the Ubuntu system proxy and custom certificate enabled, then inspect the project for proxy and certificate-handling entry points. Use the cert_issuer_source_aia.cc and ssl_client_socket_impl.cc messages, along with the installed manual-updater/index.js path, to distinguish sync failure from updater errors. Done means notes sync normally through the proxy without the recurring TLS failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, typescript, ubuntu
Domain
desktop, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.