Unable to connect to jupyter kernel gateway on Safari Version >= 13.1

[applecool]

Hey,

I am unable to connect to the jupyter kernel over the web socket on Safari.
I get this error: WebSocket network error: OSStatus error - 9801: Cipher Suite negotiation failure

Any idea how this can be fixed?

PS: Big fan of the project ✌️

[kevin-bates]

If this is an issue, its likely down in tornado - but that's rough at best. I did find this comment that might prove helpful. Are you using Safari 13.1 and wss?

[applecool]

Yes I am using wss and Safari 13.1, 13.1.1, 13.1.2, and other builds of Safari 13.1.2 as well (14609.3.5.1.5,15609.3.5.1.3)

[kevin-bates]

This is way out of my realm - sorry. Based on the linked comment, this sounds like a TLS version issue and that the "quality" of your certificate makes a difference. Have you looked into this from that angle? Is downgrading Safari to 13.0 a temporary option?

[applecool]

I read the comment which you mentioned in the first comment. I do have a self-signed root CA. Created this certificate using OpenSSL. The following is what I see on my certificate in keychain:

The comment also mentioned about using the mkcert. I'll give that a shot.

On the other hand, Seems like there is no way to downgrade the version of Safari. I did do some research but couldn't find any leads on that. Most of the articles I found asked me to take a backup and clean install which is not an option for me. It would be awesome if you could point me to an article to downgrade to 13.0 :)

[kevin-bates]

It would be awesome if you could point me to an article to downgrade to 13.0

Yeah, I'm finding the same as you. Looks like Safari is essentially baked into the OS - which is why downgrades are unacceptable. That's a drag.

I would imagine you'd see a similar issue hitting notebook directly (no JKG) if you used a more secure approach since that's where the websocket handling is located. If you remain stuck, you might try the Notebook discourse forum since the audience might be larger.

[applecool]

Got it. Nevertheless, thank you so much for all the helpful info. I'll check out the notebook forum as well. I'll update here if I find any solution.

[kevin-bates]

Hi @applecool - I stumbled upon this comment today in the Notebook repo and checked if JKG has a similar capability for configuring this - turns out it does. As a result, I would try updating your JKG configuration to use ssl_version = 5 so that tornado uses TLS 1.2.

[applecool]

Hey @kevin-bates but I don't see a ssl_version or ssl_options config option on the JKG i.e., KernelGatewayApp. Am I missing something here? I went through the docs too (and I don't see it here).

[kevin-bates]

interesting - although Notebook exposes all of the ssl_options, JKG only exposes the fields of ssl_options except ssl_version! 😄

Seems like we should expose ssl_version, but first I'd prefer we determine that is indeed your issue. Are you in a position to build JKG after appropriately changing this line to try this out? I'm assuming you're already setting one of {certfile,keyfile, ca_certs} already. If that works, we can add a similar configurable for ssl_version.

If you'd like to do that (the full change), that would be awesome, but I don't want to proceed until we know this solves your issue.

[applecool]

I was able to modify the line to ssl_options.setdefault('ssl_version', 5) and it worked 🥳 ! I was able to properly connect to the gateway on Safari and I also don't see any deprecation warnings like the following on Chrome:
The connection used to load resources from https://applecool.blah.com:9999 used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future. Once disabled, users will be prevented from loading these resources. The server should enable TLS 1.2 or later. See https://www.chromestatus.com/feature/5654791610957824 for more information.

[kevin-bates]

Sweet! Would you like to take a crack at contributing this update? It would follow nearly identically to the other three SSL options.

[applecool]

Absolutely :)