Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

docker image doesn't support tls 1.3 #7000

Closed
richvdh opened this issue Feb 26, 2020 · 3 comments
Closed

docker image doesn't support tls 1.3 #7000

richvdh opened this issue Feb 26, 2020 · 3 comments
Labels
A-Docker Docker images, or making it easier to run Synapse in a container. z-p2 (Deprecated Label)

Comments

@richvdh
Copy link
Member

richvdh commented Feb 26, 2020

for some reason, we build the docker image against libressl rather openssl, and libressl don't yet support tls1.3: libressl/portable#228.

That means that any docker-based synapse is going to fail to talk to a server which requires tls1.3 - which is becoming increasingly common.

@richvdh
Copy link
Member Author

richvdh commented Feb 26, 2020

(also worth noting here that because the docker image is based on alpine linux, we cannot use the manylinux cryptography wheels which use a statically-linked openssl)

@neilisfragile neilisfragile added z-p2 (Deprecated Label) A-Docker Docker images, or making it easier to run Synapse in a container. labels Mar 9, 2020
@maquis196
Copy link
Contributor

testing today, not sure this is a problem anymore;

`
openssl s_client -connect localhost:8448 -tls1_3

Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
`
Was going to look at replacing libressl with openssl in our alpine dockerfile but alas, the above works. (tested with - Digest: sha256:71ee09081211)

@richvdh
Copy link
Member Author

richvdh commented Aug 6, 2020

testing today, not sure this is a problem anymore;

I'm not quite sure how that happened, but either way it should have been fixed by #7839.

@richvdh richvdh closed this as completed Aug 6, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
A-Docker Docker images, or making it easier to run Synapse in a container. z-p2 (Deprecated Label)
Projects
None yet
Development

No branches or pull requests

3 participants