F-Droid throws TLS error when connecting to TLS 1.3

• Device OS and version: Android N 7.0
• Device model/manufacturer: HTC One A9 hiaeuhl
• F-Droid version (in the About screen): noticed in 0.102.3, now at 0.103.1 (worked and still works in 0.100)
• F-Droid privileged extension version (if installed): No

What did you do? (clear steps if possible)

• Add repo https://fdroid.j2ghz.com/repo
• Pull down, Updating repositories

What did you expect to see?

• Apps to be displayed

What did you see instead?

Error getting index file

05-27 00:07:43.294 21270 23265 E UpdateService: Error updating repository https://fdroid.j2ghz.com/repo
05-27 00:07:43.294 21270 23265 E UpdateService: org.fdroid.fdroid.RepoUpdater$UpdateException: Error getting index file
05-27 00:07:43.294 21270 23265 E UpdateService:         at org.fdroid.fdroid.IndexV1Updater.update(IndexV1Updater.java:124)
05-27 00:07:43.294 21270 23265 E UpdateService:         at org.fdroid.fdroid.UpdateService.onHandleIntent(UpdateService.java:412)
05-27 00:07:43.294 21270 23265 E UpdateService:         at android.app.IntentService$ServiceHandler.handleMessage(IntentService.java:67)
05-27 00:07:43.294 21270 23265 E UpdateService:         at android.os.Handler.dispatchMessage(Handler.java:102)
05-27 00:07:43.294 21270 23265 E UpdateService:         at android.os.Looper.loop(Looper.java:173)
05-27 00:07:43.294 21270 23265 E UpdateService:         at android.os.HandlerThread.run(HandlerThread.java:61)
05-27 00:07:43.294 21270 23265 E UpdateService: Caused by: javax.net.ssl.SSLHandshakeException: Handshake failed
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:429)
05-27 00:07:43.294 21270 23265 E UpdateService:         at info.guardianproject.netcipher.client.TlsOnlySocketFactory$DelegateSSLSocket.startHandshake(TlsOnlySocketFactory.java:274)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.Connection.connectTls(Connection.java:235)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.Connection.connectSocket(Connection.java:199)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.Connection.connect(Connection.java:172)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.Connection.connectAndSetOwner(Connection.java:367)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.OkHttpClientconnectAndSetOwner(OkHttpClient.java:130)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:329)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:246)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:457)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:405)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponseCode(HttpURLConnectionImpl.java:521)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getResponseCode(DelegatingHttpsURLConnection.java:105)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java)
05-27 00:07:43.294 21270 23265 E UpdateService:         at org.fdroid.fdroid.net.HttpDownloader.download(HttpDownloader.java:86)
05-27 00:07:43.294 21270 23265 E UpdateService:         at org.fdroid.fdroid.IndexV1Updater.update(IndexV1Updater.java:99)
05-27 00:07:43.294 21270 23265 E UpdateService:         ... 5 more
05-27 00:07:43.294 21270 23265 E UpdateService:         Suppressed: javax.net.ssl.SSLHandshakeException: Handshake failed
05-27 00:07:43.294 21270 23265 E UpdateService:                 ... 21 more
05-27 00:07:43.294 21270 23265 E UpdateService:                 Suppressed: javax.net.ssl.SSLHandshakeException: Handshake failed
05-27 00:07:43.294 21270 23265 E UpdateService:                         ... 21 more
05-27 00:07:43.294 21270 23265 E UpdateService:                 Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x7f639365c0: Failure in SSL library, usually a protocol error
05-27 00:07:43.294 21270 23265 E UpdateService: error:1000043e:SSL routines:OPENSSL_internal:TLSV1_ALERT_INAPPROPRIATE_FALLBACK (external/boringssl/src/ssl/s3_pkt.c:610 0x7f617da3c0:0x00000001)
05-27 00:07:43.294 21270 23265 E UpdateService:                         at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
05-27 00:07:43.294 21270 23265 E UpdateService:                         at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
05-27 00:07:43.294 21270 23265 E UpdateService:                         ... 20 more
05-27 00:07:43.294 21270 23265 E UpdateService:         Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x7f639365c0: Failure in SSL library, usually a protocol error
05-27 00:07:43.294 21270 23265 E UpdateService: error:1000043e:SSL routines:OPENSSL_internal:TLSV1_ALERT_INAPPROPRIATE_FALLBACK (external/boringssl/src/ssl/s3_pkt.c:610 0x7f617da720:0x00000001)
05-27 00:07:43.294 21270 23265 E UpdateService:                 at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
05-27 00:07:43.294 21270 23265 E UpdateService:                 at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
05-27 00:07:43.294 21270 23265 E UpdateService:                 ... 20 more
05-27 00:07:43.294 21270 23265 E UpdateService: Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x7f639365c0: Failure in SSL library, usually a protocol error
05-27 00:07:43.294 21270 23265 E UpdateService: error:1000043e:SSL routines:OPENSSL_internal:TLSV1_ALERT_INAPPROPRIATE_FALLBACK (external/boringssl/src/ssl/s3_pkt.c:610 0x7f617da7e0:0x00000001)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
05-27 00:07:43.294 21270 23265 E UpdateService:         at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
05-27 00:07:43.294 21270 23265 E UpdateService:         ... 20 more
05-27 00:07:43.295 21270 23265 I UpdateService: Updating repo(s) complete, took 0 seconds to complete.

I thought it could be a problem with the sites certificate, but it downloads https://fdroid.j2ghz.com/repo/index.jar in chrome without any problems or warnings. I found similar reports on okhttp github, they said to use https://www.ssllabs.com/ssltest/ to check the site, so I did https://www.ssllabs.com/ssltest/analyze.html?d=fdroid.j2ghz.com&latest and it didn't show any problems.

changed the description

Same for me on Android 4.3: Getting 'error getting index file' on almost all repos with 103.x Qick example for testing it is oeffi.schildbach.de/fdroid/repo

Reinstalled 102.3 and all is fine again...

closed

Based on that stacktrace, the issue lies in your HTTPS/TLS configuration on the server side. My guess is that you have stripped down the cipher list too much to support older devices. Try a standard TLS config. Chrome will allow sloppier TLS configs that F-Droid will.

@eighthave I turned off support for TLS 1.3 in CloudFlare and it works now. In version 0.100 it works whether disabled or enabled.

Oops, we're not on the bleeding edge of TLS!

reopened

changed title from Error getting index file: SSLHandshakeException to F-Droid throws TLS error when connecting to TLS 1.3

changed milestone to %1.0

changed milestone to %1.1