Failed to fetch room list

This issue has been migrated from [#12253](https://github.com/matrix-org/synapse/issues/12253).

---

### Description

I am using latest synapse docker image (v1.54), everything seems to work fine except I cannot list remote public rooms from app.element.io, it says "Failed to fetch room list" (all external homeserver fails: matrix.org, gitter.im, libera.chat). I am having this issue since I installed synapse (v1.52).

Federation seems ok: https://federationtester.matrix.org/#imatt.ch

In the synapse logs we can see it fails to verify the remote server SSL certificate (here matrix.org) :
```
matrix_synapse.1.hirryiykm2t0@web9 | 2022-03-18 21:13:45,364 - synapse.access.http.8008 - 427 - INFO - GET-1582 - 80.219.12.248 - 8008 - {@matthieu.barthel:imatt.ch} Processed request: 0.001sec/0.001sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 2B 200 "GET /_matrix/client/r0/thirdparty/protocols HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" [0 dbevts]
matrix_synapse.1.hirryiykm2t0@web9 | 2022-03-18 21:13:45,462 - synapse.http.matrixfederationclient - 649 - INFO - POST-1583 - {GET-O-2} [matrix.org] Request failed: GET matrix://matrix.org/_matrix/federation/v1/publicRooms?include_all_networks=false&limit=20: ResponseNeverReceived:[Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])]
matrix_synapse.1.hirryiykm2t0@web9 | 2022-03-18 21:13:45,954 - synapse.http.matrixfederationclient - 649 - INFO - POST-1583 - {GET-O-2} [matrix.org] Request failed: GET matrix://matrix.org/_matrix/federation/v1/publicRooms?include_all_networks=false&limit=20: ResponseNeverReceived:[Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])]
matrix_synapse.1.hirryiykm2t0@web9 | 2022-03-18 21:13:46,850 - synapse.http.matrixfederationclient - 649 - INFO - POST-1583 - {GET-O-2} [matrix.org] Request failed: GET matrix://matrix.org/_matrix/federation/v1/publicRooms?include_all_networks=false&limit=20: ResponseNeverReceived:[Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])]
matrix_synapse.1.hirryiykm2t0@web9 | 2022-03-18 21:13:49,500 - synapse.http.matrixfederationclient - 649 - INFO - POST-1583 - {GET-O-2} [matrix.org] Request failed: GET matrix://matrix.org/_matrix/federation/v1/publicRooms?include_all_networks=false&limit=20: ResponseNeverReceived:[Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])]
matrix_synapse.1.hirryiykm2t0@web9 | 2022-03-18 21:13:49,501 - synapse.http.server - 95 - INFO - POST-1583 - SynapseError: 502 - Failed to fetch room list
```

The SSL verification seems fine from the docker host and the synapse container :
```
root@6151c1073bd8:/# openssl s_client -showcerts -connect matrix.org:443
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = www.matrix.org
verify return:1
---
Certificate chain
0 s:CN = www.matrix.org
i:C = US, O = Let's Encrypt, CN = R3
-----BEGIN CERTIFICATE-----
MIIG6DCCBdCgAwIBAgISBM7BiY4r42zWwv1Dh6/5GljwMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjAxMjUwNzU4MDlaFw0yMjA0MjUwNzU4MDhaMBkxFzAVBgNVBAMT
Dnd3dy5tYXRyaXgub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
rb/4AkYQ7UoG3vUOH2fLjP2wVPKQoRz4knAi+MnELLsSeqjYA2alp/7kDx2RmeP8
VbSUicl68/uK8FZWmuWyuf5+Fg+zDJi6iOz+mdGxwjIVxbgu55LSpy+6G5Vrlqxo
LGtvFyrcvKHNmfTsF5qa795xDXDLIpIuw7z4n0ufk9QLsAArhK4bzXgKkSKJDIZa
ds57rSJHjiefhzGwPTB78V3VZaagS4vQCt5Le1WrjLQbE0UujZ40q6+kzVaUWGWk
FOH0n+U2zM+eaOJTPUwz/+bxUBMilk4Y8LKnVXwTR7ffcEVuNvTwsq4SOt80Nkac
vDE+EWPPseM5PEvEesqzf2r7xByhOD9DjXZVxyxie1Yqadl4ORKLLMydLgSFrtZw
nGU/gdIJESWxouVoFSwQ9Mt8eMef0p7KwIy1cu+rWdVgqT0A9PsIuubuMyy/9xIJ
V5QDyw2gcVEL1qZptRXQfk1hJPdOwcxTONiMTJVnemgwGhNFrkHfdGyfW7Ll71bZ
B+JPC+euTS01DImDDOy8jCaWSzMw2qzqHKkc9MjScybV92x4mP66fVTGBkA+GAw3
uFFRf+L8gfjS5pABkUFUU7fuyZGDGtjMrEYkqVnUfj7MGuDYPpqGgrsttNMZLz/U
tdNXWMyiP0jzQ5Zs2TNOcdU6OCCm6rrsFoTogzCaDf8CAwEAAaOCAw8wggMLMA4G
A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYD
VR0TAQH/BAIwADAdBgNVHQ4EFgQUnbZw115TEUazQk/fV8AEmuR0RjAwHwYDVR0j
BBgwFoAUFC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsG
AQUFBzABhhVodHRwOi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6
Ly9yMy5pLmxlbmNyLm9yZy8wgd0GA1UdEQSB1TCB0oINYWJvdXQucmlvdC5pbYIR
YXJld2VyZWFkeXlldC5jb22CDmxmcy5tYXRyaXgub3JnghhtYXRyaXgtY2xpZW50
Lm1hdHJpeC5vcmeCHG1hdHJpeC1mZWRlcmF0aW9uLm1hdHJpeC5vcmeCCm1hdHJp
eC5vcmeCCW1hdHJpeC50b4IKbW9kdWxhci5pbYIHcmlvdC5pbYIPc3BlYy5tYXRy
aXgub3Jnggl2ZWN0b3IuaW2CDnd3dy5tYXRyaXgub3Jngg53d3cubW9kdWxhci5p
bTBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUF
BwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQUGCisGAQQB1nkCBAIE
gfYEgfMA8QB3AEHIyrHfIkZKEMahOglCh15OMYsbA+vrS8do8JBilgb2AAABfpB0
70sAAAQDAEgwRgIhAN8Hoqf4wDDec4giZvK7FBtzPKHT9zbKsGnER9GXIjhYAiEA
/2ziF5cJrajoTlY8gXyvj4sPMRBFpbr7DyP0wsEpwR8AdgApeb7wnjk5IfBWc59j
pXflvld9nGAK+PlNXSZcJV3HhAAAAX6QdO8zAAAEAwBHMEUCIAjlIo2o9cnuu18E
FsCj4FvdMiUCksUtcEZjATBc4L5lAiEA1CKPT9aA3nFTy63Hm3MKdHV197EhRbBe
WflSmrl71jIwDQYJKoZIhvcNAQELBQADggEBAB3rzyTkM8Dh26oR7xyVGOVPWlHz
KFvyvvKEc84LE3DV31tPFKXwXnSATEUnjKlSTIQ72UxaqdIfBiUUikmk5qHzTNeh
ZHKEUqGzq4Tt7yqZSXSp+jfyTRbaLBI7FmAKZoEEO9m4ef8wvFXel2zxHpYtb7eG
VSJXEMR8c1N1+GgaKNryHh7aTFNz1jibctV9nPjHgpP6XJU+9EgdBvcoTisbrLjZ
JOgaNT6CFO2DWk7ule+R4vNiiSq+baqEn3S10ouPcv4TWe6JWxHtwdj3wQUHx8aW
bCeAmbtg5TFQZAT0Zq90U+EASwTByyZJ4rFYmjdm5902Vr+UXTQI692LWrM=
-----END CERTIFICATE-----
1 s:C = US, O = Let's Encrypt, CN = R3
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
---
Server certificate
subject=CN = www.matrix.org

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 5218 bytes and written 382 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
```

I believe the SSL verification issue is somewhere related to python in the docker image.

### Steps to reproduce

My synapse installation is probably pretty common, I use keycloak as authentication provider with a self signed certificate but I don't see any relation.

I get the error from Element when I try to list public rooms :


### Version information

- **Homeserver**:

If not matrix.org:

- **Version**: Synapse 1.54 / Python 3.9.10

- **Install method**: Docker

- **Platform**: Docker Swarm on Ubuntu 20.04, Traefik as reverse proxy