Fallback to insecure connection when connecting to S3 with SSL

daq · August 31, 2017, 7:09pm

Does Duplicati try to fall back to insecure connection via S3 even when SSL checkbox is selected?

I’m getting TLS negotiation errors on my Minio server inconsistently and their team suggested a client might be trying an insecure connection. Duplicati is the only client connecting to my Minio server and I confirmed that the connection that fails to negotiate TLS is coming from Duplicati.

I enabled the option to accept-any-ssl-certificate and it does work most of the time. The errors are sporadic.

These errors show up in Duplicati log:

Operation List with file attempt 5 of 5 failed with message: A WebException with status TrustFailure was thrown.
Amazon.Runtime.AmazonServiceException: A WebException with status TrustFailure was thrown. —> System.Net.WebException: Error: TrustFailure (Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
at /home/abuild/rpmbuild/BUILD/mono-5.0.1.1/external/boringssl/ssl/handshake_client.c:1132) —> Mono.Btls.MonoBtlsException: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
at /home/abuild/rpmbuild/BUILD/mono-5.0.1.1/external/boringssl/ssl/handshake_client.c:1132

Thanks.

kenkendk · September 1, 2017, 11:28am

I just found this bug today, but basically the TrayIcon keeps a connection to the webserver, and this connection overrides the running backup’s settings

I even marked it as a TODO, but then completely forgot about it:

github.com

duplicati/duplicati/blob/master/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs#L392


        }

    }

}



private T PerformRequestInternal<T>(string method, string endpoint, Dictionary<string, string> queryparams)

{

    queryparams["format"] = "json";



    string query = EncodeQueryString(queryparams);



    // TODO: This can interfere with running backups, 

    // as the System.Net.ServicePointManager is shared with

    // all connections doing ftp/http requests

    using (var httpOptions = new Duplicati.Library.Modules.Builtin.HttpOptions())

    {

        httpOptions.Configure(m_options);



        var req =

            (System.Net.HttpWebRequest) System.Net.WebRequest.Create(

                new Uri(m_apiUri + endpoint + '?' + query));

        req.Method = method;

This means that the --accept-any-ssl-certificate is reset every time the tray-icon requests the status from the webserver …

I think the errors you see on Minio are caused by Duplicati dropping the connection when it sees the invalid certificate.