No warning if access to the control plane server blocked by network on Windows client

[EDIflyer]

What is the issue?

New installation of Tailscale on a laptop connected to a corporate guest WiFi network.
Not provided with any warning of an issue when trying to login, just didn't work.
I appreciate if may not be possible for you to do anything about being blocked, but from a new user perspective it would be helpful to display a warning to the user both when trying to register initially and also when subsequently trying to use Tailscale rather than just silently fail.

Steps to reproduce

1. Download Tailscale Windows client
2. Install client
3. Right click on icon in system tray and try to login
4. No error, no warning, no login popup
5. Try multiple time, reboot system, no change
6. Look at log files and realise the issue is the Tailscale app is unable to contact the control plane server - try to access this directly and note it is blocked (unbeknownst to me) by the corporate firewall.
7. Connect to home network instead and complete registration successfully

Are there any recent changes that introduced the issue?

N/A

OS

Windows

OS version

Windows 11 23H2 22631.4460

Tailscale version

1.76.6

Other software

N/A

Bug report

BUG-0fcd40826ad5dcdaadfc0b71ba98274fcaa89228727ae72fd76331690c0691bd-20241118180825Z-286d4890fe337b20

[bradfitz]

cc @agottardo

[agottardo]

We have health warnings to inform the user about this, but the Windows client doesn't yet display them.

cc @dblohm7 @nickkhyl to screen this

[agottardo]

@EDIflyer please attach a bug report identifier as well.

[EDIflyer]

@agottardo I'm at home just now where it works fine - I'll be back at the location with the firewall restriction next Tuesday, I can generate one then if you want? Or would running tailscale bugreport just now on the laptop where I had the issue last week (on 12th Nov) be sufficient for you to check back through things? (that's why I didn't attach one initially as I thought it might have been too long ago!)

[agottardo]

@EDIflyer please provide one now, I can look back at the logs if you can give me an approximate date and time you were connected to the problematic network

[EDIflyer]

@agottardo ideal - have edited to add the bug report ID now. It was just under a week ago so I'd estimate 09:20 GMT on 12/11/24. It was the first time I was trying to register that laptop, I then successfully did so that evening when I got home.

[agottardo]

Verified the network in question was performing a man-in-the-middle attack on encrypted HTTPS traffic:

2024-11-12T09:24:26Z | Received error: fetch control key: Get "https://controlplane.tailscale.com/key?v=106": x509: certificate signed by unknown authority

We need a better UX for this, especially on Windows.

[EDIflyer]

Ahh, interesting - glad you could see it @agottardo ! As mentioned it's a guest WiFi network on a corporate network so I guess not surprising that they're doing that. As you say if the user could be warned that would be ideal, probably just something like a small warning triangle on the tray icon with a message showing in the Tailscale pop-up if clicked on? Also perhaps if the control plane server can't be reached then grey out the option to login to avoid that initial setup confusion?