adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 02:42:21 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

[Ubuntu 16.04.1 + ZNC 1.6.3+deb1] SSL handshake timeouts #732

New Issue
Closed
opened 2026-10-05 04:41:36 +02:00 by adam · 10 comments
adam commented 2026-10-05 04:41:36 +02:00
Owner
Copy link
Copy source

Nothing is shown on stderr. Connecting over separate, unencrypted port works fine, connecting over SSL port fails.

Let me know, what do you need to properly reproduce and debug this.

Nothing is shown on stderr. Connecting over separate, unencrypted port works fine, connecting over SSL port fails. Let me know, what do you need to properly reproduce and debug this. <!-- github-sync-id:187554860 -->
adam closed this issue 2026-10-05 04:41:36 +02:00
adam commented 2026-10-05 04:41:37 +02:00
Author
Owner
Copy link
Copy source

Run ZNC with the -D (debug) flag.

Run ZNC with the `-D` (debug) flag. <!-- github-comment-id:258673884 -->
adam commented 2026-10-05 04:41:38 +02:00
Author
Owner
Copy link
Copy source

Absolutely nothing relevant shows neither on stdout, nor on stderr

Absolutely nothing relevant shows neither on stdout, nor on stderr <!-- github-comment-id:258674133 -->
adam commented 2026-10-05 04:41:38 +02:00
Author
Owner
Copy link
Copy source

And you are sure the port is open and not blocked by a firewall or behind NAT?

And you are sure the port is open and not blocked by a firewall or behind NAT? <!-- github-comment-id:258687663 -->
adam commented 2026-10-05 04:41:39 +02:00
Author
Owner
Copy link
Copy source

PORT STATE SERVICE
31337/tcp open Elite

And all ports are open on my IRC end. I did not mess with my firewall
config, so the port is still open.

Results of openssl s_client ran from the localhost:

CONNECTED(00000003)
140367625135768:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1478445860
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
PORT STATE SERVICE 31337/tcp open Elite And all ports are open on my IRC end. I did not mess with my firewall config, so the port is still open. Results of `openssl s_client` ran from the localhost: ``` CONNECTED(00000003) 140367625135768:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 305 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1478445860 Timeout : 300 (sec) Verify return code: 0 (ok) --- ``` <!-- github-comment-id:258688056 -->
adam commented 2026-10-05 04:41:40 +02:00
Author
Owner
Copy link
Copy source

You wouldn't happen to be trying to connect over SSL to the plain text port would you? I don't think ZNC supports SSL and plain text on the same port...

You wouldn't happen to be trying to connect over SSL to the plain text port would you? I don't think ZNC supports SSL and plain text on the same port... <!-- github-comment-id:258688208 -->
adam commented 2026-10-05 04:41:40 +02:00
Author
Owner
Copy link
Copy source

That's why I set up plaintext on another port, but, to satiate your
curiosity, connecting plaintext over not-working SSL port still failed.

That's why I set up plaintext on another port, but, to satiate your curiosity, connecting plaintext over not-working SSL port still failed. <!-- github-comment-id:258688293 -->
adam commented 2026-10-05 04:41:41 +02:00
Author
Owner
Copy link
Copy source

Try the same port number over which you got a successful plain text connection. If znc --debug does not say anything, then the connection does not reach znc. It will print something for sure even before it actually accepts the connection.

Try the same port number over which you got a successful plain text connection. If znc --debug does not say anything, then the connection does not reach znc. It will print something for sure even before it actually accepts the connection. <!-- github-comment-id:258691795 -->
adam commented 2026-10-05 04:41:42 +02:00
Author
Owner
Copy link
Copy source

Do I have to try SSL over it, or plaintext?

Do I have to try SSL over it, or plaintext? <!-- github-comment-id:258691846 -->
adam commented 2026-10-05 04:41:43 +02:00
Author
Owner
Copy link
Copy source

Either - it'll print something in either case, I believe

Either - it'll print something in either case, I believe <!-- github-comment-id:258714173 -->
adam commented 2026-10-05 04:41:43 +02:00
Author
Owner
Copy link
Copy source

It was not a bug, the PEM file was wrong.

It was not a bug, the PEM file was wrong. <!-- github-comment-id:260137531 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#732