WebDAV TLSV1_ALERT_PROTOCOL_VERSION

Support
1

Hi. I have a backup to a WebDAV server (NextCloud 26.0.2 on YunoHost (Debian)) that had been working for a long time and stopped working 2 days ago. Now I can’t connect to my WebDAV server; when I “Test connection”, I get the following exception (running Duplicati from the CLI):

Ssl error:1000042e:SSL routines:OPENSSL_internal:TLSV1_ALERT_PROTOCOL_VERSION

System.Net.WebException: Error: SecureChannelFailure (Authentication failed, see inner exception.) —> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. —> Mono.Btls.MonoBtlsException: Ssl error:1000042e:SSL routines:OPENSSL_internal:TLSV1_ALERT_PROTOCOL_VERSION
at ./external/boringssl/ssl/tls_record.c:462
at Mono.Btls.MonoBtlsContext.ProcessHandshake () [0x00064] in :0
at Mono.Net.Security.MobileAuthenticatedStream.ProcessHandshake (Mono.Net.Security.AsyncOperationStatus status, System.Boolean renegotiate) [0x00106] in :0
at (wrapper remoting-invoke-with-check) Mono.Net.Security.MobileAuthenticatedStream.ProcessHandshake(Mono.Net.Security.AsyncOperationStatus,bool)
at Mono.Net.Security.AsyncHandshakeRequest.Run (Mono.Net.Security.AsyncOperationStatus status) [0x00006] in :0
at Mono.Net.Security.AsyncProtocolRequest.ProcessOperation (System.Threading.CancellationToken cancellationToken) [0x0012a] in :0
— End of inner exception stack trace —
at Mono.Net.Security.MobileAuthenticatedStream.ProcessAuthentication (System.Boolean runSynchronously, Mono.Net.Security.MonoSslAuthenticationOptions options, System.Threading.CancellationToken cancellationToken) [0x00346] in :0
at Mono.Net.Security.MonoTlsStream.CreateStream (System.Net.WebConnectionTunnel tunnel, System.Threading.CancellationToken cancellationToken) [0x001f4] in :0
at System.Net.WebConnection.CreateStream (System.Net.WebOperation operation, System.Boolean reused, System.Threading.CancellationToken cancellationToken) [0x001f5] in :0
— End of inner exception stack trace —
at System.Net.WebConnection.CreateStream (System.Net.WebOperation operation, System.Boolean reused, System.Threading.CancellationToken cancellationToken) [0x00275] in :0
at System.Net.WebConnection.InitConnection (System.Net.WebOperation operation, System.Threading.CancellationToken cancellationToken) [0x0015b] in :0
at System.Net.WebOperation.Run () [0x000b7] in :0
at System.Net.WebCompletionSource1[T].WaitForCompletion () [0x000b1] in <a85c1a570f9a4f9f9c3d2cfa5504e34f>:0 at System.Net.HttpWebRequest.RunWithTimeoutWorker[T] (System.Threading.Tasks.Task1[TResult] workerTask, System.Int32 timeout, System.Action abort, System.Func`1[TResult] aborted, System.Threading.CancellationTokenSource cts) [0x00118] in :0
at Duplicati.Library.Utility.AsyncHttpRequest+AsyncWrapper.GetResponseOrStream () [0x0004d] in :0
at Duplicati.Library.Utility.AsyncHttpRequest.GetRequestStream (System.Int64 contentlength) [0x00068] in :0
at Duplicati.Library.Backend.WEBDAV.ListWithouExceptionCatch () [0x0004a] in <1aa1326b13664b9f92f75d7048721a2d>:0
at Duplicati.Library.Backend.WEBDAV.List () [0x000a5] in <1aa1326b13664b9f92f75d7048721a2d>:0
at Duplicati.Library.Backend.WEBDAV.Test () [0x00000] in <1aa1326b13664b9f92f75d7048721a2d>:0
at Duplicati.Server.WebServer.RESTMethods.RemoteOperation.TestConnection (System.String url, Duplicati.Server.WebServer.RESTMethods.RequestInfo info) [0x000b7] in <30a34d71126b48248d040dda634ddad9>:0
at Duplicati.Server.WebServer.RESTMethods.RemoteOperation.POST (System.String key, Duplicati.Server.WebServer.RESTMethods.RequestInfo info) [0x00091] in <30a34d71126b48248d040dda634ddad9>:0
at Duplicati.Server.WebServer.RESTHandler.DoProcess (Duplicati.Server.WebServer.RESTMethods.RequestInfo info, System.String method, System.String module, System.String key) [0x00289] in <30a34d71126b48248d040dda634ddad9>:0

However, I can still browse my WebDAV with a regular client (Dolphin file manager).

I first thought that this would be because I had just changed my server’s TLS compatibility settings to Modern.[1][2] However, after switching them back to Intermediate (and rebooting my server), nothing changed. I tried toying with allowed-ssl-versions, to no avail.

I updated to Duplicati - 2.0.7.1_beta_2023-05-25, on Linux (Kubuntu LTS).

What can I do?

2

Hello

I would recommend intermediate compatibility indeed.

could you please provide a screenshot of a Wireshark capture session ? (sudo apt install wireshark, launch with: sudo wireshark) - no need to post the whole session, the 20 first lines should be sufficient. Also if you can export your config and post it here after anonymising it and renaming it to .txt it could help.
Edit: no renaming a .json file to .txt will not help, I always forget how restrictive this forum is. Zip the json file. Or post it inline after adding 3 backticks ``` at the beginning of a newline to remove any formatting.

1 Like
3

Thank you for your reply. Here’s what you asked.

The :4 IP is my server and the fully blanked IP is my laptop with Duplicati. I noticed that one field in the TLS Hello says “Version: TLS 1.0” but I don’t know whether that’s abnormal.

1-Hello
1-Hello1813×864 179 KB

2-Alert
2-Alert1819×509 118 KB

duplicati-config.json 
{
  "CreatedByVersion": "2.0.7.1",
  "Schedule": {
    "ID": 3,
    "Tags": [
      "ID=5"
    ],
    "Time": "2023-06-18T12:00:00Z",
    "Repeat": "1D",
    "LastRun": "2023-06-17T12:01:21Z",
    "Rule": "AllowedWeekDays=Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday",
    "AllowedDays": [
      "mon",
      "tue",
      "wed",
      "thu",
      "fri",
      "sat",
      "sun"
    ]
  },
  "Backup": {
    "ID": "5",
    "Name": "xxx",
    "Description": "",
    "Tags": [],
    "TargetURL": "webdavs://xxx:443/nextcloud/remote.php/dav/files/xxx/?auth-username=xxx",
    "DBPath": "/home/xxx/.config/Duplicati/HRSDHPXYLP.sqlite",
    "Sources": [],
    "Settings": [
      {
        "Filter": "",
        "Name": "encryption-module",
        "Value": "aes",
        "Argument": null
      },
      {
        "Filter": "",
        "Name": "compression-module",
        "Value": "zip",
        "Argument": null
      },
      {
        "Filter": "",
        "Name": "dblock-size",
        "Value": "50mb",
        "Argument": null
      },
      {
        "Filter": "",
        "Name": "retention-policy",
        "Value": "1W:1D,4W:1W,12M:1M",
        "Argument": null
      }
    ],
    "Filters": [],
    "Metadata": {
      "LastDuration": "00:01:57.6395020",
      "LastStarted": "20181213T191850Z",
      "LastFinished": "20181213T192047Z",
      "LastBackupDate": "20230613T120000Z",
      "BackupListCount": "19",
      "TotalQuotaSpace": "0",
      "FreeQuotaSpace": "0",
      "AssignedQuotaSpace": "-1",
      "TargetFilesSize": "192884874634",
      "TargetFilesCount": "7458",
      "TargetSizeString": "179,64 GB",
      "SourceFilesSize": "183783460271",
      "SourceFilesCount": "274786",
      "SourceSizeString": "171,16 GB",
      "LastBackupStarted": "20230613T120000Z",
      "LastBackupFinished": "20230613T120415Z",
      "LastErrorDate": "20230617T120239Z",
      "LastErrorMessage": "Error: SecureChannelFailure (Authentication failed, see inner exception.)",
      "LastRestoreDuration": "00:17:19.3045630",
      "LastRestoreStarted": "20220604T011037Z",
      "LastRestoreFinished": "20220604T012757Z",
      "LastBackupDuration": "00:04:15.3223580",
      "LastCompactDuration": "00:00:15.3400930",
      "LastCompactStarted": "20230613T120353Z",
      "LastCompactFinished": "20230613T120408Z"
    },
    "IsTemporary": false
  },
  "DisplayNames": {}
}
4

I don’t know the exact meaning of the TLSV1 message, but it’s clear that your Duplicati is asking for a TLS 1.2 connection. Never mind the 1.0, that’s not meaning anything.
The value returned by the server is a single byte (0x70) that means that there is a problem with the ‘protocol’ and there is no information available for the client software to give a meaningful error message. It does not work and that’s the end of it. This is not great but this particular feature of awful error messages is not a problem specific to Duplicati.

I’m afraid that with Kubuntu 22.04 - or well, mono so any Linux or Mac version of Duplicati - it’s not possible to get TLS 1.3 for Duplicati, and there is not much point in asking for a lower version than 1.2 (it should not be accepted in most cases).

allowed-ssl-versions don’t seem to be used at all with backends.

Now why is your host not liking that is hard to guess. If I try with Dolphin I get a Tls 1.3 connection. If you want to verify that your server accepts a TLS 1.2 connection only (and that’s all we can hope with Duplicati currently), you can use

openssl s_client -tls1_2 -connect (your-host-here):(your-host-port)

that would be probably

openssl s_client -tls1_2 -connect (your-host-here):443

if it works, you get about 3 pages of text with certificates; if it fails, openssl output about 15 lines of text and says SSL handshake has read 0 bytes (when it works, SSL handshake read a number of bytes > 0)

If openssl connection with Tls 1.2 does not work, your server is not configured to work with Duplicati.

HTH

1 Like
5

That was it; the openssl command showed me that my nginx was still on Modern setting. I must have failed to save the configuration properly.

Thank you for your very informative answer!