TLS handshake error (ws+tls)

Help
21

Only use websockets. I am sure of that, thank you.

22

This topic was automatically closed after 30 days. New replies are no longer allowed.

23

Conclusion:

https://caddy.community/t/appending-tls-handshake-error-ws-tls/14474

24

Sorry I opened a new post because the old post is closed.

This question is fixed, and I want to share how.

Caddy is strictly case-sensitive, as shown in the old post, my Caddy config.json is following

sub.esdomain.com {
 tls {
   protocols tls1.2 tls1.3
   ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
   curves x25519
 }
 @staff_websocket {
  path /3367
  header Connection *Upgrade*
  header Upgrade websocket
 }
 reverse_proxy @staff_websocket localhost:37566
}

But the proxy tool Iā€™m using sends the header like Connection *upgrade*, and I added a new block in config.json

@staff_websocket_alias {
  path /3367
  header Connection *upgrade*
  header Upgrade websocket
 }
reverse_proxy @staff_websocket_alias localhost:37566

Thatā€™s all.

1 Like
25

What you can do is this:

@staff_websocket {
	path /3367
	header Connection *Upgrade*
	header Connection *upgrade*
	header Upgrade websocket
}

Caddy will then match either of those Connection header patterns.

But really, do you even need the matcher? If the only thing that site block has is that proxy, then you can completely omit the matcher.

Also, this is redundant, because theyā€™re already the defaults, so you can remove it:

Also, why are you changing the ciphers? Thereā€™s rarely any benefit to doing that. Caddyā€™s defaults are secure.

I donā€™t think Letā€™s Encrypt nor ZeroSSL supports curve x25519 yet. I donā€™t think thisā€™ll actually work. Caddy allows configuring it, but I donā€™t think a cert will be successfully issued with that key type. This option will actually do nothing unless you set key_type, because the default is still to issue RSA keys.

1 Like
26

I see, thank you.

27

I added additional information in edits above, in case you missed it.

28

In order not to create confusion with the previous post, I did not delete the content, such as protocols tls1.2 tls1.3.

I used the default configuration information of the proxy protocol, and you will see these config thing.

I just removed the matcher and tested, it works, thank you.