"Error: Handshake failed" on certain https downloads about download-navi

[proninyaroslav]

Does this happen when connected or at download time?

[Pentaphon]

@proninyaroslav It tries to download it but it goes to the completed tab with "Error: Handshake Failed". Just paste that link into the manager and you will see this.

[proninyaroslav]

I tried to download the first few seconds and didn't see the error

[Pentaphon]

@proninyaroslav That's odd. Not sure why you don't see it. I got it 3 times in a row.

[proninyaroslav]

This error indicates that there is no certificate on the device. I use only system certificates.

[proninyaroslav]

I will think how to fix it.

[proninyaroslav]

Most likely fixed: 7ac9b1d. I can't check this error, but if you come across it in a future release, feel free to reopen issue.

[mrblarg64]

I still get this error on 1.3.1 (f-droid) on my server.

https://www.bernmern.ca/

I am using this application because the built-in downloadmanager in lineage os 14.1 has the same problem. The browser (jelly) works fine, however if I try to save/download something it fails.

I am running a rather "unique" configuration.

https://www.ssllabs.com/ssltest/analyze.html?d=www.bernmern.ca

[proninyaroslav]

This is primarily the problem of missing SSL root certificates. Alternatively, it's possible to disable the check (make it optional), but I would not recommend doing this, especially in the downloader app, which will be vulnerable to various kinds of attacks. If you think otherwise, you can open an issue with this proposal.

[mrblarg64]

I was going to manually install the missing root certificate, then I found out it is already there.

I was able to verify that the root certificate is indeed installed on the lineage os 14.1 device (it is installed by default) (Settings -> Security -> Trusted credentials -> The USERTRUST Network) serial number: "01:FD:6D:30:FC:A3:CA:51:A8:1B:BC:64:0E:35:03:2D"

Edit: sha-256 fingerprint: "E7:93:C9:B0:2F:D8:AA:13:E2:1C:31:22:8A:CC:B0:81:19:64:3B:74:9C:89:89:64:B1:74:6D:46:C3:D4:CB:D2"

There is no missing root certificate.

Copy-pasted from ssl labs:

1 Sent by server bernmern.ca
Fingerprint SHA256: 0f8bdc5542ee53ac1431888336919a2552b5dca37dd43f8aff419312a9f7e0db
Pin SHA256: SiLOTvp9cFHhHTSjB0ULzM1e+dKlDh8KVo3Wppp17i4=
RSA 8192 bits (e 65537) / SHA256withRSA

2 Sent by server Sectigo RSA Domain Validation Secure Server CA
Fingerprint SHA256: 7fa4ff68ec04a99d7528d5085f94907f4d1dd1c5381bacdc832ed5c960214676
Pin SHA256: 4a6cPehI7OG6cuDZka5NDZ7FR8a60d3auda+sKfg4Ng=
RSA 2048 bits (e 65537) / SHA384withRSA

3 In trust store USERTrust RSA Certification Authority Self-signed
Fingerprint SHA256: e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd2
Pin SHA256: x4QzPSC810K5/cMjb05Qm4k3Bw5zBn4lTdO/nEW/Td4=
RSA 4096 bits (e 65537) / SHA384withRSA

[proninyaroslav]

@mrblarg64
I just checked downloading from your site on my device (Android 10) and there is no problem with the certificate. Maybe I'm using the wrong link?

[mrblarg64]

Looks like the right link, any bernmern.ca/www.bernmern.ca https link should trigger this behaviour.

[proninyaroslav]

@mrblarg64
What version of Navi and Android are you using?

[mrblarg64]

Download Navi - 1.5 (f-droid)
Android - Lineage OS 14.1 (Android 7.1.2)

I would speculate it has something to do with OS libraries (I have no idea how android/java works), based on what I said earlier...

The built-in downloadmanager in lineage os 14.1 has the same problem. The browser (jelly) works fine, however if I try to save/download something in the browser it fails.

[proninyaroslav]

This is a possible solution https://support.sectigo.com/PS_KnowledgeDetailPage?Id=kA01N000000zFL1

[mrblarg64]

My server is already sending the certificate chain (see above ("Copy-pasted from ssl labs....")).

There is no need to send the root.

https://stackoverflow.com/questions/34945244/should-the-trusted-root-ca-be-a-part-of-the-certificate-chain

[proninyaroslav]

I tried to download in three different versions of Android: 5.1, 7.1 and 8.1. And 7.1 failed with a similar message, while 8.1 and 5.1 downloaded it without problems. It's pretty funny and weird. It's possible that Android 7.1 contains some kind of bug in the network layer, or doesn't contain the entire chain of trusted certificates. Have you checked it?

[mrblarg64]

Have you checked it?

Assuming you mean the cert is being sent, yes, I have checked it.

A valid certificate chain that ends with The USERTRUST Network (serial number: "01:FD:6D:30:FC:A3:CA:51:A8:1B:BC:64:0E:35:03:2D" sha-256 fingerprint: "E7:93:C9:B0:2F:D8:AA:13:E2:1C:31:22:8A:CC:B0:81:19:64:3B:74:9C:89:89:64:B1:74:6D:46:C3:D4:CB:D2") is being sent by the server.

Evidence:

1 Sent by server bernmern.ca
Fingerprint SHA256: 0f8bdc5542ee53ac1431888336919a2552b5dca37dd43f8aff419312a9f7e0db
Pin SHA256: SiLOTvp9cFHhHTSjB0ULzM1e+dKlDh8KVo3Wppp17i4=
RSA 8192 bits (e 65537) / SHA256withRSA

2 Sent by server Sectigo RSA Domain Validation Secure Server CA
Fingerprint SHA256: 7fa4ff68ec04a99d7528d5085f94907f4d1dd1c5381bacdc832ed5c960214676
Pin SHA256: 4a6cPehI7OG6cuDZka5NDZ7FR8a60d3auda+sKfg4Ng=
RSA 2048 bits (e 65537) / SHA384withRSA

3 In trust store USERTrust RSA Certification Authority Self-signed
Fingerprint SHA256: e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd2
Pin SHA256: x4QzPSC810K5/cMjb05Qm4k3Bw5zBn4lTdO/nEW/Td4=
RSA 4096 bits (e 65537) / SHA384withRSA

You can verify yourself here:

https://www.ssllabs.com/ssltest/analyze.html?d=www.bernmern.ca

[proninyaroslav]

I'm talking about the presence of the entire chain on your device.

[mrblarg64]

Yes, the root certificate (number 3 in the list on the previous comment) is found in Settings -> Security -> Trusted credentials -> The USERTRUST Network. The other certificates are sent by the server as shown above. The 2 sent by the server coupled with the root form a valid chain.

Edit: typo

[proninyaroslav]

Have you checked the date of this certificate on the device?

[mrblarg64]

I'm not sure what you mean.

for the USERTRUST cert
On device:
it was issued on 2010-01-31
it expires on 2038-01-18

this matches what firefox shows on my laptop.
sha256 fingerprint and serial number also match

[proninyaroslav]

I think this is related to this bug in Android 7.0 https://issuetracker.google.com/issues/37122132. But they pointed out that it's fixed in 7.1.1. I can still reproduce this problem in 7.1.1.

[mrblarg64]

Would it be possible to include a TLS library (i.e. gnutls/openssl) in the app without depending on the operating system?

It appears that the browsers already do this and this is why the browser works fine (saw this link after going down the rabbit hole on the link you posted)

https://community.letsencrypt.org/t/warning-android-7-0-clients-not-browsers-can-only-use-curve-prime256v1/23212

[proninyaroslav]

I think not, because this is an interaction with the Java library inside OS.