"failed first bytes of tls handshake" when connecting from windows / android via faketls

[Rightarion]

hey!

context:

• v1
• faketls

weirdly, when i connect from my mac or ios device, everything works just fine. however, if i connect via the same link from a windows device, it does not work and in the logs it's saying this:

{"level":"warn","ts":1771032396.1606166,"logger":"proxy","msg":"Cannot perform client handshake","connection_id":"fe670fad875d26d1","error":"failed first bytes of tls handshake"}

it works just fine on all devices when using simple or secure secrets.

i tried the same thing on v2, and faketls works very well across all devices, tested on mac and windows. i'd use v2, but it doesn't have the support for ad tag which i desperately need.

any ideas how to fix this?

[9seconds]

There is no any specifics related to OS in the protocol. If you are able to connect from one device, and it works, then proxy works just fine. The rest of errors come from communication between your client and Telegram.

If you have a problems with faketls, it could be a time clock drift on either server or client side. Try to sync with NTP on both ends to verify it is not an issue

[Rightarion]

This is exactly why I reached out – it should work just fine on any OS, but it doesn't. Try it yourself:

https://t.me/proxy?server=tg.rightarion.ru&port=443&secret=ee9050b5862fee09c8d26dfe47b39f4ab36164732e78352e7275

If you have an Apple device and a non-apple device, try comparing the behavior on both. So far I've tested with a dozen of people, and the outcome is the same – works on iOS, fails on Windows.

But as I said, v2 doesn't have the same issue and works just fine.

NTP is synced btw.

[Rightarion]

UPD: just tested on non-AppStore macOS version – doesn't work. So it's probably not the OS issue but rather TG client issue

So far it seems like mtg v1 fakeTLS works only on swift-based telegram clients

[9seconds]

To be honest, I'm lost why. To help you, I would like to suggest you to check https://github.com/telemt/telemt they claim middle-proxy support as a first class citizen. This probably suits your needs much better.

[Rightarion]

Yes, I'm actually in the process of trying their solution now.

I've been searching and it seems that TD non-swift clients stopped sending an SNI after some version, which I was able to confirm by checking nginx stream logs - SNI only appeared when connecting via swift-based clients.

Anyway, thank you for your support!