Weird SSL issues

[Dominique St-Pierre Boucher]

Hello Qubes community!

I have a weird issue with SSL (HTTPS) access.

Here is my setup: Debian 9 minimal sys-net - Fedora 24 minimal sys-firewall. Any app-vm running Fedora 24 or Debian 9 (have not tested any other) have issues connecting to https sites with Chrome, Chromium or Firefox-esr. Sometimes it works, sometimes not...

I have tested on numerous wired and wireless network with the same result.

Please help me figure this out!

Dominique

[Bernhard]

Hello, I sometimes have SSL issues that all from the fact that the time
in the appvm are wrong (sometimes even in the future) - although dom0 is
accurately set up. If you have a cure to that (especially for debian) I
am interested ... maybe you experience the same problem? Bernhard

[Unman]

Dominique

Is this something new, or have you always had this problem?

Have you updated your kernel in the VMs? If so, there's a known issue
affecting SSL. Try changing the kernel that you are using in the qubes
to an earlier version and see if that helps.

unman

[Dominique St-Pierre Boucher]

Thanks for the quick answer. Do I change the kernel in the sys-net / sys-firewall or on the app-vm or both?

Thanks

Dominique

[Reg Tiangha]

On 06/07/2017 08:43 AM, Bernhard wrote:
>> Hello Qubes community!
>>
>> I have a weird issue with SSL (HTTPS) access.
>>
>> Here is my setup: Debian 9 minimal sys-net - Fedora 24 minimal sys-firewall. Any app-vm running Fedora 24 or Debian 9 (have not tested any other) have issues connecting to https sites with Chrome, Chromium or Firefox-esr. Sometimes it works, sometimes not...
>>

>> I have tested on numerous wired and wireless network with the same result..

>>
>> Please help me figure this out!
>>
>> Dominique
>>
> Hello, I sometimes have SSL issues that all from the fact that the time
> in the appvm are wrong (sometimes even in the future) - although dom0 is
> accurately set up. If you have a cure to that (especially for debian) I
> am interested ... maybe you experience the same problem? Bernhard
>

Are you running kernel 4.9.29 from current-testing? There's a workaround
in this thread here:

https://github.com/QubesOS/qubes-issues/issues/2840#issuecomment-305938895

And it should be fixed in the next kernel release.