element-hq / element-hq/synapse

tlsv1 alert protocol version (Synapse can't make TLS 1.3 requests, FreeBSD)

Open
#17,046 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

### Description

Hi,

some admins who (like me) run their own homeservers told me their servers won't get room updates directly from my server, it takes another server to accept them, and relay them to their homeservers.

### Steps to reproduce

- send a message in room
- get feedback from some users that my messages lag, that they don't get updates directly from my homeserver, it needs for some other server to accept them, then relay them to their homeserver
- check log and observe abovementioned INFO message

### Homeserver

mimar.rs

### Synapse Version

1.104.0

### Installation Method

Other (please mention below)

### Database

PostgreSQL

### Workers

Single process

### Platform

FreeBSD jail (14.0 x64) running on FreeBSD host (14.0 x64).

### Configuration

I added `federation_client_minimum_tls_version: "1.2"` but the problem remains.

### Relevant log output

```shell
(real domain changed to example.org)
2024-04-04 10:33:42,479 - synapse.http.matrixfederationclient - 799 - INFO - federation_transaction_transmission_loop-4667- {PUT-O-4699} [example.org] Request failed: PUT matrix-federation://example.org/_matrix/federation/v1/send/1712218846484: RequestTransmissionFailed:[Error([('SSL routines', '', 'tlsv1 alert protocol version')])]
```

### Anything else that would be useful to know?

Same situation happens with current FreeBSD port/package (1.98.0). I created my custom port and upgraded to 1.104.0 (will send patches to FreeBSD after a few days of running it if no problems appear), but the problem remains.

Contributor guide

Open the contributing guide

Research direction

Start with the federation_transaction_transmission_loop log entry in synapse.http.matrixfederationclient and investigate the TLS alert when sending federation requests from FreeBSD. Compare the configured federation_client_minimum_tls_version with the observed negotiation and reproduce the failure; done means Synapse can make the affected TLS requests and federation updates arrive directly.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.