search

jstaf / onedriver

A native Linux filesystem for Microsoft OneDrive
GNU General Public License v3.0
1.92k stars 96 forks source link

Error performing TLS handshake: The Diffie-Hellman prime sent by the server is not acceptable (not long enough) #243

Open prbuen opened 2 years ago

prbuen commented 2 years ago

I am trying to use this with a OneDrive business account. When trying to sign in using the organisation sign in option, it does get me to the organisation's login but after entering my login name, I get the error in the title. This error message occurs elsewhere. Post #8 by Simon Déziel at https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/1866974 resolves the issue. Not sure if there is anything else that should be done?

jstaf commented 2 years ago

This is a similar error to https://github.com/jstaf/onedriver/issues/177. Basically one of the Microsoft auth sites uses a bunch of legacy crypto settings. At the same time, the default GnuTLS security settings have been getting stricter. So some people are encountering errors on Microsoft's sites with newer distros with stricter crypto policies (like Fedora). Browsers like Firefox handle legacy sites like Microsoft's correctly, but the WebkitGTK browser we're using here is a bit more pedantic and throws an error here.

I think some people have yelled at microsoft to fix the site, but yeah, in the meantime there's not too much we can do aside from add exceptions/workarounds (I could try to add another exception just for this, not sure if it's worth the effort though).

Out of curiosity what distribution (and version of that distro) did you see the error on?

prbuen commented 2 years ago

Thanks for the explanations, Jeff :) I was doing this on Kubuntu 21.10 (kernel version 5.13.0-52-generic (64-bit), not sure about what were the two digits '52' back then, though, I do upgrades every fortnight or so).

jstaf commented 2 years ago

Thanks, I'll need to try this out on Kubuntu 21.10 sometime (and newer, since it's possible the crypto settings have changed again).

neouyghur commented 1 year ago

The following setup works for me. You can read more here sudo mkdir /etc/gnutls cat << EOF | sudo tee -a /etc/gnutls/config [overrides] default-priority-string = NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2:+VERS-DTLS1.2:%PROFILE_LOW EOF