element-hq / element-hq/synapse
register_new_matrix_user doesn't work with "tls: true" listener
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
### Description
...with self signed certificate.
If I understand correctly, the preferred setup of synapse is behind a separate reverse proxy using a self-signed certificate to encrypt traffic to the proxy if proxy + synapse aren't both on `127.0.0.1`.
When trying to register a new user on the host running synapse using `register_new_matrix_user --user myUser --password 'myPassword' --config /etc/synapse/homeserver.yaml https://localhost:8008` it fails with `CERTIFICATE_VERIFY_FAILED`.
### Steps to reproduce
- setup synapse according to the manual
- configure self signed certificate and set `tls: true` for your listener on port 8008
- try to use `register_new_matrix_user` on the host running synapse
### Homeserver
a new test homeserver
### Synapse Version
{"server_version":"1.128.0"}
### Installation Method
Other (please mention below)
### Database
sqlite
### Workers
I don't know
### Platform
Gentoo, no vm or container.
### Configuration
config:
```
server_name: "matrix.example.com"
pid_file: /var/lib/synapse/homeserver.pid
tls_certificate_path: "/etc/synapse/cert.crt"
tls_private_key_path: "/etc/synapse/cert.key"
listeners:
- port: 8008
tls: true
type: http
x_forwarded: true
bind_addresses: ['0.0.0.0']
resources:
- names: [client, federation]
compress: false
database:
name: sqlite3
args:
database: /var/lib/synapse/homeserver.db
log_config: "/etc/synapse/matrix.example.com.log.config"
media_store_path: /var/lib/synapse/media_store
registration_shared_secret: "secret"
report_stats: false
macaroon_secret_key: "anotherSecret"
form_secret: "thirdSecret"
signing_key_path: "/etc/synapse/matrix.example.com.signing.key"
suppress_key_server_warning: true
trusted_key_servers:
- server_name: "matrix.org"
```
### Relevant log output
```shell
Traceback (most recent call last):
File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 464, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 1093, in _validate_conn
conn.connect()
File "/usr/lib/python3.12/site-packages/urllib3/connection.py", line 741, in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/site-packages/urllib3/connection.py", line 920, in _ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 460, in ssl_wrap_socket
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 504, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/ssl.py", line 455, in wrap_socket
return self.sslsocket_class._create(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/ssl.py", line 1041, in _create
self.do_handshake()
File "/usr/lib/python3.12/ssl.py", line 1319, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1014)
```
### Anything else that would be useful to know?
Maybe an option for `register_new_matrix_user` to not check certificates would be useful, like curl's `--insecure` parameter.
Contributor guide
Assessment
This issue has not been assessed yet.