You are not logged in.

Pages: 1

#1 Today 09:49:31

KunshanWang
Member
Registered: 2013-06-26
Posts: 1

Luanti, curl and TLS error

Since I ran `pacman -Syu` on 11 November 2026, Luanti can no longer get the server list, and the error message is:

2026-11-12 17:12:36: ERROR[CurlFetch]: HTTPFetch for https://servers.luanti.org/list?proto_version_min=37&proto_version_max=53 failed: SSL connect error
2026-11-12 17:12:36: ERROR[CurlFetch]: HTTPFetch for https://servers.luanti.org/geoip failed: SSL connect error

Both URLs can be opened normally in Firefox, but `curl` will fail with the same error:

$ pacman -Q curl
curl 8.23.0-2
$ curl --version
curl 8.23.0 (x86_64-pc-linux-gnu) libcurl/8.23.0 OpenSSL/4.1.0 zlib/1.4 brotli/1.2.1 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.71.0 ngtcp2/1.26.0 nghttp3/1.19.0 mit-krb5/1.22.2
Release-Date: 2026-10-14
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt mqtts pop3 pop3s rtsp scp sftp smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz PSL SPNEGO SSL threadsafe UnixSockets zstd
$ curl -vv https://servers.luanti.org/geoip
17:13:55.117527 [0-0] * [HTTPS-CONNECT] added
17:13:55.117634 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 0 socks
17:13:55.124134 [0-0] * [HTTPS-CONNECT] connect, init
17:13:55.124163 [0-0] * [HTTPS-CONNECT] 1st attempt uses h2 from wanted versions
17:13:55.124171 [0-0] * [SETUP] happy eyeballing to origin servers.luanti.org:443
17:13:55.124194 [0-0] *   Trying [2a00:7c80:0:1e8::f]:443...
17:13:55.124251 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:13:55.124261 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
17:13:55.124445 [0-0] * Host servers.luanti.org:443 was resolved.
17:13:55.124463 [0-0] * IPv6: 2a00:7c80:0:1e8::f
17:13:55.124469 [0-0] * IPv4: 93.190.143.88
17:13:55.124479 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:13:55.124488 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
17:13:55.324899 [0-0] *   Trying 93.190.143.88:443...
17:13:55.325000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:13:55.325021 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 2 socks
17:13:55.399169 [0-0] * [SETUP] added SSL filter for origin
17:13:55.400896 [0-0] * ALPN: curl offers h2,http/1.1
17:13:55.401511 [0-0] * TLSv1.3 (OUT), TLS handshake, Client hello (1):
17:13:55.401583 [0-0] * SSL Trust Anchors:
17:13:55.408126 [0-0] *   CAfile: /etc/ssl/certs/ca-certificates.crt
17:13:55.408135 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:13:55.408141 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
17:13:55.734980 [0-0] * TLSv1.3 (IN), TLS alert, decode error (562):
17:13:55.735039 [0-0] * TLS connect error: error:0A00041A:SSL routines::tlsv1 alert decode error
17:13:55.735049 [0-0] * [HTTPS-CONNECT] connect, all attempts failed
17:13:55.735057 [0-0] * [HTTPS-CONNECT] connect -> 35, done=0
17:13:55.735084 [0-0] * closing connection #0
curl: (35) TLS connect error: error:0A00041A:SSL routines::tlsv1 alert decode error

But `wget` works.

wget https://servers.luanti.org/geoip
--2026-11-12 17:44:01--  https://servers.luanti.org/geoip
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving servers.luanti.org (servers.luanti.org)... 2a00:7c80:0:1e8::f, 93.190.143.88
Connecting to servers.luanti.org (servers.luanti.org)|2a00:7c80:0:1e8::f|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19 [application/json]
Saving to: ‘geoip’

geoip                                              100%[=============================================================================================================>]      19  --.-KB/s    in 0s

2026-11-12 17:44:05 (26.9 MB/s) - ‘geoip’ saved [19/19]

I compiled `curl` from source using the Git master version https://github.com/curl/curl, and it has the same error.

I noticed that the `openssl` package is upgraded to version version 4, and curl is linked against that.

$ pacman -Q openssl openssl-3
openssl 4.1.0-1
openssl-3 3.5.9-2
$ ldd /usr/bin/curl | grep libssl
        libssl.so.4 => /usr/lib/libssl.so.4 (0x00007f77ef005000)

If I link curl with openssl-3 (by specifying `-DOpenSSL_ROOT=/usr/lib/openssl-3` in `cmake`), the resulting curl will work.  (I don't know why ldd shows both libssl.so.3 and libssl.so.4)

$ ldd ./install/bin/curl | grep libssl
        libssl.so.3 => /usr/lib/libssl.so.3 (0x00007ff07d7b1000)
        libssl.so.4 => /usr/lib/libssl.so.4 (0x00007ff07c2ff000)
$ LD_LIBRARY_PATH=./install/lib ./install/bin/curl -vv https://servers.luanti.org/geoip
17:37:24.358733 [0-0] * [HTTPS-CONNECT] added
17:37:24.358831 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 0 socks
17:37:24.384026 [0-0] * [HTTPS-CONNECT] connect, init
17:37:24.384048 [0-0] * [HTTPS-CONNECT] 1st attempt uses h2 from wanted versions
17:37:24.384067 [0-0] * [SETUP] happy eyeballing to origin servers.luanti.org:443
17:37:24.384078 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:37:24.384099 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 0 socks
17:37:25.164477 [0-0] *   Trying 93.190.143.88:443...
17:37:25.164831 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:37:25.164887 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
17:37:25.213647 [0-0] * Host servers.luanti.org:443 was resolved.
17:37:25.213684 [0-0] * IPv6: 2a00:7c80:0:1e8::f
17:37:25.213697 [0-0] * IPv4: 93.190.143.88
17:37:25.213720 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:37:25.213739 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
17:37:25.365093 [0-0] *   Trying [2a00:7c80:0:1e8::f]:443...
17:37:25.365252 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:37:25.365285 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 2 socks
17:37:25.367802 [0-0] * [SETUP] added SSL filter for origin
17:37:25.369760 [0-0] * ALPN: curl offers h2,http/1.1
17:37:25.370374 [0-0] * TLSv1.3 (OUT), TLS handshake, Client hello (1):
17:37:25.370479 [0-0] * SSL Trust Anchors:
17:37:25.379075 [0-0] *   CAfile: /etc/ssl/certs/ca-certificates.crt
17:37:25.379093 [0-0] *   CApath: /etc/ssl/certs
17:37:25.379115 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
17:37:25.379132 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
17:37:25.573286 [0-0] * TLSv1.3 (IN), TLS handshake, Server hello (2):
17:37:25.573990 [0-0] * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
17:37:25.574024 [0-0] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
17:37:25.574077 [0-0] * TLSv1.3 (IN), TLS handshake, Certificate (11):
17:37:25.575285 [0-0] * TLSv1.3 (IN), TLS handshake, CERT verify (15):
17:37:25.575421 [0-0] * TLSv1.3 (IN), TLS handshake, Finished (20):
17:37:25.575508 [0-0] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
17:37:25.575572 [0-0] * TLSv1.3 (OUT), TLS handshake, Finished (20):
17:37:25.575676 [0-0] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / RSASSA-PSS
17:37:25.575692 [0-0] * ALPN: server accepted h2
17:37:25.575708 [0-0] * Server certificate:
17:37:25.575730 [0-0] *   subject: CN=servers.luanti.org
17:37:25.575746 [0-0] *   start date: Oct  7 10:15:36 2026 GMT
17:37:25.575758 [0-0] *   expire date: Jan  5 10:15:35 2027 GMT
17:37:25.575774 [0-0] *   issuer: C=US; O=Let's Encrypt; CN=YR2
17:37:25.575819 [0-0] *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
17:37:25.575832 [0-0] *   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
17:37:25.575843 [0-0] *   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
17:37:25.575863 [0-0] *   Certificate level 3: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
17:37:25.575894 [0-0] *   subjectAltName: "servers.luanti.org" matches cert's "servers.luanti.org"
17:37:25.575911 [0-0] * OpenSSL verify result: 0
17:37:25.575923 [0-0] * SSL certificate verified via OpenSSL.
17:37:25.575944 [0-0] * [SETUP] query ALPN
17:37:25.575959 [0-0] * [SETUP] adding HTTP/2 filter
17:37:25.575972 [0-0] * [SETUP] using HTTP/2 (via ALPN)
17:37:25.576023 [0-0] * [HTTP/2] [0] created h2 session
17:37:25.576057 [0-0] * [HTTP/2] [0] -> FRAME[SETTINGS, len=18]
17:37:25.576075 [0-0] * [HTTP/2] [0] -> FRAME[WINDOW_UPDATE, incr=1048510465]
17:37:25.576093 [0-0] * [HTTP/2] cf_connect() -> 0, 1,
17:37:25.576108 [0-0] * [HTTPS-CONNECT] connect -> 0, done=1
17:37:25.576171 [0-0] * Established connection to servers.luanti.org (93.190.143.88 port 443) from 192.168.1.12 port 42784
17:37:25.576190 [0-0] * [HTTPS-CONNECT] removing connected setup filter
17:37:25.576207 [0-0] * [HTTPS-CONNECT] destroy
17:37:25.576223 [0-0] * [SETUP] removing connected setup filter
17:37:25.576233 [0-0] * [SETUP] destroy
17:37:25.576301 [0-0] * [HTTP/2] [1] OPENED stream for https://servers.luanti.org/geoip
17:37:25.576317 [0-0] * [HTTP/2] [1] [:method: GET]
17:37:25.576331 [0-0] * [HTTP/2] [1] [:scheme: https]
17:37:25.576346 [0-0] * [HTTP/2] [1] [:authority: servers.luanti.org]
17:37:25.576359 [0-0] * [HTTP/2] [1] [:path: /geoip]
17:37:25.576374 [0-0] * [HTTP/2] [1] [user-agent: curl/8.23.1-DEV]
17:37:25.576394 [0-0] * [HTTP/2] [1] [accept: */*]
17:37:25.576408 [0-0] * [HTTP/2] [1] submit -> 0, 89
17:37:25.576435 [0-0] * [HTTP/2] [1] -> FRAME[HEADERS, len=43, hend=1, eos=1]
17:37:25.576493 [0-0] * [HTTP/2] [1] cf_send(len=89) -> 0, 89, eos=1, h2 windows 65535-65535 (stream-conn), buffers 0-0 (stream-conn)
17:37:25.576508 [0-0] > GET /geoip HTTP/2
17:37:25.576508 [0-0] > Host: servers.luanti.org
17:37:25.576508 [0-0] > User-Agent: curl/8.23.1-DEV
17:37:25.576508 [0-0] > Accept: */*
17:37:25.576508 [0-0] >
17:37:25.576572 [0-0] * Request completely sent off
17:37:25.576602 [0-0] * [HTTP/2] [1] local window update by 10420225
17:37:25.576638 [0-0] * [HTTP/2] [0] ingress: done
17:37:25.576669 [0-0] * [HTTP/2] [1] -> FRAME[WINDOW_UPDATE, incr=10420225]
17:37:25.576685 [0-0] * [HTTP/2] [1] -> FRAME[WINDOW_UPDATE, incr=10420225]
17:37:25.576717 [0-0] * [HTTP/2] [1] cf_recv(len=102400) -> 81, 0, window=0/20905985, connection 1048576000/1048576000
17:37:25.880914 [0-0] * [HTTP/2] [0] ingress: read 46 bytes
17:37:25.880963 [0-0] * [HTTP/2] [0] <- FRAME[SETTINGS, len=24]
17:37:25.880981 [0-0] * [HTTP/2] [0] MAX_CONCURRENT_STREAMS: 128
17:37:25.880990 [0-0] * [HTTP/2] [0] ENABLE_PUSH: TRUE
17:37:25.880999 [0-0] * [HTTP/2] [0] notify MAX_CONCURRENT_STREAMS: 128
17:37:25.881011 [0-0] * [HTTP/2] [0] <- FRAME[WINDOW_UPDATE, incr=2147418112]
17:37:25.881025 [0-0] * [HTTP/2] [0] ingress: nw-in buffered 0
17:37:25.881051 [0-0] * [HTTP/2] [0] ingress: read 9 bytes
17:37:25.881068 [0-0] * [HTTP/2] [0] <- FRAME[SETTINGS, ack=1]
17:37:25.881079 [0-0] * [HTTP/2] [0] ingress: nw-in buffered 0
17:37:25.881095 [0-0] * [HTTP/2] [0] ingress: read 138 bytes
17:37:25.881123 [0-0] < HTTP/2 200
17:37:25.881175 [0-0] * [HTTP/2] [1] status: HTTP/2 200
17:37:25.881198 [0-0] < server: nginx
17:37:25.881215 [0-0] * [HTTP/2] [1] header: server: nginx
17:37:25.881234 [0-0] < date: Thu, 12 Nov 2026 09:37:33 GMT
17:37:25.881247 [0-0] * [HTTP/2] [1] header: date: Thu, 12 Nov 2026 09:37:33 GMT
17:37:25.881270 [0-0] < content-type: application/json
17:37:25.881282 [0-0] * [HTTP/2] [1] header: content-type: application/json
17:37:25.881292 [0-0] < content-length: 19
17:37:25.881304 [0-0] * [HTTP/2] [1] header: content-length: 19
17:37:25.881319 [0-0] < cache-control: max-age=604800, private
17:37:25.881332 [0-0] * [HTTP/2] [1] header: cache-control: max-age=604800, private
17:37:25.881347 [0-0] < access-control-allow-origin: *
17:37:25.881357 [0-0] * [HTTP/2] [1] header: access-control-allow-origin: *
17:37:25.881375 [0-0] * [HTTP/2] [1] <- FRAME[HEADERS, len=101, hend=1, eos=0]
17:37:25.881391 [0-0] <
{"continent":"AS"}
17:37:25.881436 [0-0] * [HTTP/2] [1] <- FRAME[DATA, len=19, eos=1, padlen=0]
17:37:25.881447 [0-0] * [HTTP/2] [1] DATA, window=19/20905986
17:37:25.881455 [0-0] * [HTTP/2] [1] CLOSED
17:37:25.881467 [0-0] * [HTTP/2] [0] ingress: nw-in buffered 0
17:37:25.881477 [0-0] * [HTTP/2] [0] ingress: done
17:37:25.881485 [0-0] * [HTTP/2] [1] returning CLOSE
17:37:25.881495 [0-0] * [HTTP/2] handle_stream_close -> 0, 0
17:37:25.881507 [0-0] * [HTTP/2] [0] -> FRAME[SETTINGS, ack=1]
17:37:25.881560 [0-0] * [HTTP/2] [1] cf_recv(len=102400) -> 0, 0, window=-1/-1, connection 1048575981/1048576000
17:37:25.881610 [0-0] * Connection #0 to host servers.luanti.org:443 left intact

I suspect the problem is with the new OpenSSL version 4 or the way curl interacts with OpenSSL 4.  I am not an expert of OpenSSL or TLS, so I don't know what exactly was wrong.

Does anyone have any clue what could be wrong?

Offline

#2 Today 12:18:54

-thc
Member
Registered: 2017-03-15
Posts: 1,230

Re: Luanti, curl and TLS error

My best guess: The new OpenSSL 4 version of curl sends a more restricted "client hello (1)" handshake and the server "servers.luanti.org" cannot comply with the expected key suites and/or algorithms. It sends two bytes (one non-alphanumeric and a "2") instead of the expected "server hello (2)". The older OpenSSL version 3 and a curl linked against it behave more "loosely" and still work. That's a concern for the admins of "servers.luanti.org".

Last edited by -thc (Today 12:56:34)

Offline

Pages: 1

Board footer

Powered by FluxBB