element-hq / element-hq/synapse

register_new_matrix_user doesn't work with "tls: true" listener

Open
#18,324 3 comments 0 reactions 0 assignees View on GitHub
A-Admin-API O-Uncommon S-Tolerable T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

### Description

...with self signed certificate.

If I understand correctly, the preferred setup of synapse is behind a separate reverse proxy using a self-signed certificate to encrypt traffic to the proxy if proxy + synapse aren't both on `127.0.0.1`.

When trying to register a new user on the host running synapse using `register_new_matrix_user --user myUser --password 'myPassword' --config /etc/synapse/homeserver.yaml https://localhost:8008` it fails with `CERTIFICATE_VERIFY_FAILED`.

### Steps to reproduce

- setup synapse according to the manual
- configure self signed certificate and set `tls: true` for your listener on port 8008
- try to use `register_new_matrix_user` on the host running synapse

### Homeserver

a new test homeserver

### Synapse Version

{"server_version":"1.128.0"}

### Installation Method

Other (please mention below)

### Database

sqlite

### Workers

I don't know

### Platform

Gentoo, no vm or container.

### Configuration

config:

```
server_name: "matrix.example.com"
pid_file: /var/lib/synapse/homeserver.pid
tls_certificate_path: "/etc/synapse/cert.crt"
tls_private_key_path: "/etc/synapse/cert.key"
listeners:
- port: 8008
tls: true
type: http
x_forwarded: true
bind_addresses: ['0.0.0.0']
resources:
- names: [client, federation]
compress: false
database:
name: sqlite3
args:
database: /var/lib/synapse/homeserver.db
log_config: "/etc/synapse/matrix.example.com.log.config"
media_store_path: /var/lib/synapse/media_store
registration_shared_secret: "secret"
report_stats: false
macaroon_secret_key: "anotherSecret"
form_secret: "thirdSecret"
signing_key_path: "/etc/synapse/matrix.example.com.signing.key"
suppress_key_server_warning: true
trusted_key_servers:
- server_name: "matrix.org"

```

### Relevant log output

```shell
Traceback (most recent call last):
File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 464, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 1093, in _validate_conn
conn.connect()
File "/usr/lib/python3.12/site-packages/urllib3/connection.py", line 741, in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/site-packages/urllib3/connection.py", line 920, in _ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 460, in ssl_wrap_socket
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 504, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/ssl.py", line 455, in wrap_socket
return self.sslsocket_class._create(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/ssl.py", line 1041, in _create
self.do_handshake()
File "/usr/lib/python3.12/ssl.py", line 1319, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1014)
```

### Anything else that would be useful to know?

Maybe an option for `register_new_matrix_user` to not check certificates would be useful, like curl's `--insecure` parameter.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.