Unable to connect to znc over ssl after a period of time #659

New Issue

2026-10-05T04:36:49+02:00

adam commented

2026-10-05 04:36:49 +02:00

I recently switched over from a Centos server running ZNC 1.4 installed from yum. I am now using Ubuntu 14.04.3 x64, and made and installed ZNC 1.6.2 from the stable release listed on wiki.znc.in, and ran it using the same config directory I copied from my old server. I also remade the znc.pem, updating the certificate and chain, and adding the DH params to the end.

Directly after starting the znc process, I was able to connect with ssl to both the web interface and with an IRC client. However I noticed at after a few hours I was unable to connect to the server over ssl anymore, although any clients that were currently connected would remain connected.

I have tried a few different versions from tarball: 1.4, 1.6, 1.6.2 (recommended version), and nightly (1.7.x-nightly-20151215-e210ade2). All of these have seemed to have the same problem for me, so it is possible it might not have to do with znc alone (although I have not had problems with ssl on anything else on this new server), but I was hoping that someone might have some insight into what might be causing this.

More details
With -D on the nightly, it prints this when I fail to connect over ssl (trying from localhost here, but the same happens for remote):

[2015-12-21 01:39:18.469994] _LISTENER == ConnectionFrom(127.0.0.1, 41569) [Allowed]
[2015-12-21 01:39:18.470046] There are [0] clients from [127.0.0.1]
[2015-12-21 01:39:18.470150] src/Csocket.cpp:1690 WARNING: MakeConnection .... SSLv23_server_method failed!

Ports: I am listening for non-ssl irc and web on 6002, IRC over ssl on 5000, and web over ssl on 6001. Here is what sudo netstat -plutn looks like after I can no longer connect:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:6001            0.0.0.0:*               LISTEN      19290/znc       
tcp        0      0 0.0.0.0:6002            0.0.0.0:*               LISTEN      19290/znc       
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2696/sshd       
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      6346/master    
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN      19290/znc  
...

Trying to connect with openssl s_client to either IRC or web:

$ openssl s_client -host localhost -port 6001
CONNECTED(00000003)
140448375039648:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:

---
no peer certificate available

---
No client certificate CA names sent

---
SSL handshake has read 0 bytes and written 295 bytes

---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

---

My znc.pem consists of in this order: The private key, the certificate, the intermediates, the CA (I know this isn't needed, but I don't think it is the problem), and finally the DH params. The certificate is valid and signed by RapidSSL. (I was also having this problem both when I had an invalid cert, and when I was missing the DH params)

Again, it works fine at first, but after a period it stops accepting new connections.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/29295726-unable-to-connect-to-znc-over-ssl-after-a-period-of-time?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

I recently switched over from a Centos server running ZNC 1.4 installed from yum. I am now using Ubuntu 14.04.3 x64, and made and installed ZNC 1.6.2 from the stable release listed on wiki.znc.in, and ran it using the same config directory I copied from my old server. I also remade the znc.pem, updating the certificate and chain, and adding the DH params to the end. Directly after starting the znc process, I was able to connect with ssl to both the web interface and with an IRC client. However I noticed at after a few hours I was unable to connect to the server over ssl anymore, although any clients that were currently connected would remain connected. I have tried a few different versions from tarball: 1.4, 1.6, 1.6.2 (recommended version), and nightly (1.7.x-nightly-20151215-e210ade2). All of these have seemed to have the same problem for me, so it is possible it might not have to do with znc alone (although I have not had problems with ssl on anything else on this new server), but I was hoping that someone might have some insight into what might be causing this. **More details** With -D on the nightly, it prints this when I fail to connect over ssl (trying from localhost here, but the same happens for remote): ``` [2015-12-21 01:39:18.469994] _LISTENER == ConnectionFrom(127.0.0.1, 41569) [Allowed] [2015-12-21 01:39:18.470046] There are [0] clients from [127.0.0.1] [2015-12-21 01:39:18.470150] src/Csocket.cpp:1690 WARNING: MakeConnection .... SSLv23_server_method failed! ``` Ports: I am listening for non-ssl irc and web on 6002, IRC over ssl on 5000, and web over ssl on 6001. Here is what `sudo netstat -plutn` looks like after I can no longer connect: ``` Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:6001 0.0.0.0:* LISTEN 19290/znc tcp 0 0 0.0.0.0:6002 0.0.0.0:* LISTEN 19290/znc tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2696/sshd tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 6346/master tcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 19290/znc ... ``` Trying to connect with openssl s_client to either IRC or web: ``` $ openssl s_client -host localhost -port 6001 CONNECTED(00000003) 140448375039648:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 295 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- ``` My znc.pem consists of in this order: The private key, the certificate, the intermediates, the CA (I know this isn't needed, but I don't think it is the problem), and finally the DH params. The certificate is valid and signed by RapidSSL. (I was also having this problem both when I had an invalid cert, and when I was missing the DH params) Again, it works fine at first, but after a period it stops accepting new connections. ## <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/29295726-unable-to-connect-to-znc-over-ssl-after-a-period-of-time?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:36:50 +02:00

If you just ssh into server, does it fix the connection?
I recall that some OSes automount and autounmount home directory of user when user is not logged in...

If you just ssh into server, does it fix the connection? I recall that some OSes automount and autounmount home directory of user when user is not logged in...

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#659