OMV Docker & Jackett: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter: The SSL connection could not be established, see inner exception. (Test)

[yeawhatever]

#8835 # Environment

OS OpenMediaVault 5.5.6.1

Jackett Version 0.16.1121.0

Jackett Version 0.16.1121.0

Using a reverse proxy which I have just set up. I am also running transmission through openVPN. I believe I need to add jacket to the VPN so all searches are not blocked by local ISPs.

Description

I have been trying to set up Jackett on OMV 5
I added a indexer and sucessfully searched/downloaded with it.

Im now getting issues with errors on every search I make. Adding any new indexer also gives errors

I believe its a docker DNS setting but not sure where to start.
Any help is appreciated

Logged Error Messages

`

0} Jackett.Common.IndexerException: Exception (1337x): error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---> Interop+Crypto+OpenSslCryptographicException: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter --- End of inner exception stack trace --- at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context, Byte[] recvBuf, Int32 recvOffset, Int32 recvCount, Byte[]& sendBuf, Int32& sendCount) at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext& context, ArraySegment1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions) --- End of inner exception stack trace --- at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception) at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest) --- End of stack trace from previous location where exception was thrown --- at System.Net.Security.SslStream.ThrowIfExceptional() at System.Net.Security.SslStream.InternalEndProcessAuthentication(LazyAsyncResult lazyResult) at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result) at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult) at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__65_1(IAsyncResult iar) at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization) --- End of stack trace from previous location where exception was thrown --- at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken) --- End of inner exception stack trace --- at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean allowHttp2, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken) at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) at CloudflareSolverRe.ClearanceHandler.SendRequestAsync(HttpRequestMessage request, CancellationToken cancellationToken) at CloudflareSolverRe.ClearanceHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts) at Jackett.Common.Utils.Clients.HttpWebClient2NetCore.Run(WebRequest webRequest) in /home/vsts/work/1/s/src/Jackett.Common/Utils/Clients/HttpWebClient2NetCore.cs:line 229 at Jackett.Common.Utils.Clients.WebClient.GetString(WebRequest request) in /home/vsts/work/1/s/src/Jackett.Common/Utils/Clients/WebClient.cs:line 114 at Jackett.Common.Indexers.BaseWebIndexer.RequestStringWithCookies(String url, String cookieOverride, String referer, Dictionary2 headers) in /home/vsts/work/1/s/src/Jackett.Common/Indexers/BaseIndexer.cs:line 449 at Jackett.Common.Indexers.CardigannIndexer.PerformQuery(TorznabQuery query) in /home/vsts/work/1/s/src/Jackett.Common/Indexers/CardigannIndexer.cs:line 1351 at Jackett.Common.Indexers.BaseIndexer.ResultsForQuery(TorznabQuery query) in /home/vsts/work/1/s/src/Jackett.Common/Indexers/BaseIndexer.cs:line 331 --- End of inner exception stack trace --- at Jackett.Common.Indexers.BaseIndexer.ResultsForQuery(TorznabQuery query) in /home/vsts/work/1/s/src/Jackett.Common/Indexers/BaseIndexer.cs:line 351 at Jackett.Common.Indexers.BaseWebIndexer.ResultsForQuery(TorznabQuery query) in /home/vsts/work/1/s/src/Jackett.Common/Indexers/BaseIndexer.cs:line 810 at Jackett.Common.Services.IndexerManagerService.TestIndexer(String name) in /home/vsts/work/1/s/src/Jackett.Common/Services/IndexerManagerService.cs:line 273 at Jackett.Server.Controllers.IndexerApiController.Test() in /home/vsts/work/1/s/src/Jackett.Server/Controllers/IndexerApiController.cs:line 130 at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited\|12_0(ControllerActionInvoker invoker, ValueTask1 actionResultValueTask) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope) at Microsoft.AspNetCore.Routing.EndpointMiddleware.g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger) at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Jackett.Server.Middleware.CustomExceptionHandler.Invoke(HttpContext httpContext) in /home/vsts/work/1/s/src/Jackett.Server/Middleware/CustomExceptionHandler.cs:line 26

2020-09-11 00:02:57 | Info | Fetching: https://1337x.to/cat/Movies/time/desc/1/

[garfield69]

you could try to test your docker image setup by

• Starting a terminal and connect to your jackett docker
  docker exec -it jackett /bin/bash
  (replace jackett with whatever you called your Jackett container).
• and then posting the results of
  curl -vvv https://1337x.to/
  and
  openssl s_client -connect 1337x.to:443
  to see if they succeed or not. if they fail they may yield a clue to what is going on

[ilike2burnthing]

This user's compose may be of use - haugene/docker-transmission-openvpn#1136, at least to check that there's nothing wrong with yours, and rule that out

[yeawhatever]

Did a complete remove/reinstall of the container. Was already using haugene transmissionopenVPN.
I have removed/reinstalled that as well. Transmission is running fine. Open VPN is up and connected (ip location confirmed)

Jacket is up and using transmissionvpn_default network (to push all queries through vpn)

See below for posts of results of lookups.
Nt sure what to try next?

• posting the results of
  curl -vvv https://1337x.to/

`root@d27bc3b2ac71:/# curl -vvv https://1337x.to/

• Trying 104.31.88.65...
• TCP_NODELAY set
• Connected to 1337x.to (104.31.88.65) port 443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS alert, Server hello (2):
• error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter
• stopped the pause stream!
• Closing connection 0
  curl: (35) error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter`

openssl s_client -connect 1337x.to:443

CONNECTED(00000005)
139881040597440:error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter:../ssl/record/rec_layer_s3.c:1528:SSL alert number 47

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 310 bytes
Verification: OK

New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

[garfield69]

Its all linux stuff, out of my expertise.
But it looks to me like the machine is not capable of processing the tls1.3 certificate.
I don't know if that is because the VPN's certificate store is out of date, or the docker certificate store is out of date, or the security libraries on the docker or VPN server are out of date.
@ngosang @cadatoiva @ilike2burnthing any input for this ticket from you?

[ilike2burnthing]

Does the same issue occur if you don't use the reverse proxy?

[yeawhatever]

I can check. What's the easiest way to stop using the reverse proxy?
Renaming the nginx proxy config file?
Or stopping the let's encrypt stack?

[ilike2burnthing]

Apologies, I don't use one, so couldn't say. I would take a guess at the config file, but... 🤷‍♂️

[ngosang]

This is an openssl issue (old ssl library without support for tls1.3). I think you are running an old version of the Docker image.

• Stop Jackett container: docker ps , docker stop ..., docker rm ...
• Remove the Jackett image:> docker images, docker rmi ...`
• Use the latest Docker image linuxserver/jackett

I'm going to improve the Docker image to provide us more info, but this will take time => linuxserver/docker-jackett#105

[yeawhatever]

This is an openssl issue (old ssl library without support for tls1.3). I think you are running an old version of the Docker image.

• Stop Jackett container: docker ps , docker stop ..., docker rm ...
• Remove the Jackett image:> docker images, docker rmi ...`
• Use the latest Docker image linuxserver/jackett

I'm going to improve the Docker image to provide us more info, but this will take time => linuxserver/docker-jackett#105

Thats worked - added new indexer and all good.
Interestingly if I add indexer that I previously had issues with, im still getting same error. presume its cached certificate or something?
Any idea how to clear out? (not in config folder as I deleted that before reinstalling)

Ideally I want to use my previous indexers
Thanks

[ngosang]

Interestingly if I add indexer that I previously had issues with, im still getting same error. presume its cached certificate or something?

No. Must be something else like DNS blockage. Some trackers have "alternative domains" in the configuration. Try them.

[yeawhatever]

Perfect. Thats got it. I will try and push jackett through the VPN now anyway so shouldn't get any issues with blocks.... but wanted to test it worked first normally before going with the VPN.

…

On Mon, 14 Sep 2020 at 09:33, Diego Heras ***@***.***> wrote: Interestingly if I add indexer that I previously had issues with, im still getting same error. presume its cached certificate or something? No. Must be something else like DNS blockage. Some trackers have "alternative domains" in the configuration. Try them. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#9487 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQ6PXN634ZUKMEHECP7L6RLSFXINNANCNFSM4RGCX4LA> .