ElementX doesn't support TLS 1.3

[singingtelegram]

Steps to reproduce

Attempting to login on a TLS v1.3 only server.

Outcome

What did you expect?

The authentication process continues.

What happened instead?

log: 🚨 AuthenticationServiceProxy.configure():60 Failed configuring a server: Generic(message: "An error occurred: error sending request for url (https://[hostname]/.well-known/matrix/client): error trying to connect: bad protocol version")

Your phone model

iPhone 12

Operating system version

16.4.1

Application version

1.0.24 (43)

Homeserver

ocf.berkeley.edu

Will you send logs?

No

[pixlwave]

Logs from Rust:

hyper::Error(Connect, Error { code: -9836, message: "bad protocol version" })

RapidAPI:

The operation couldn’t be completed. (kCFStreamErrorDomainSSL error -9836.)

[jplatte]

We use the system's native TLS library, could it be that it's just OpenSSL (?) on your system being too old? There's the possibility of bundling rustls but it will increase the binary size (not sure how much).

[yu-re-ka]

The Rust native-tls crate uses the Secure Transport API on iOS.

https://support.apple.com/guide/security/tls-security-sec100a75d12/web

TLS clients using the SecureTransport APIs can’t use TLS 1.3.

[manuroe]

@singingtelegram does legacy EI work on your server?

[singingtelegram]

yes, the Element app does work with our server.

[fuomag9]

For anyone encountering this, I needed to set tls 1.2 as the MAXIMUM allowed TLS version on ALL my servers (domain with the .well-known, actual matrix server and proxy as well)

On caddy that can be done via

# Temp fix because of https://github.com/vector-im/element-x-ios/issues/786
tls {
protocols tls1.2 tls1.2
}

[csett86]

It seems that only Rusts native-tls crate does not support TLS 1.3: sfackler/rust-native-tls#140, while the underlying security-framework crate supports it (https://docs.rs/security-framework/latest/security_framework/secure_transport/struct.SslProtocol.html#associatedconstant.TLS13), because Apples underlying Secure Transport support it since a while now: https://developer.apple.com/documentation/security/tls_protocol_version_t/tls_protocol_version_tlsv13

Fortunately someone is working on it already: sfackler/rust-native-tls#235

Also Element iOS works fine with TLS 1.3 only homeservers.