federation tester started to complain about wildcard ssl certificate

[tgurr]

Describe the bug https://federationtester.matrix.org/ started to report an error for our server instead of displaying the current version string.

There was an error looking up homeserver version information: Get "matrix://matrix.stadt-heilbronn.de:443/_matrix/federation/v1/version": x509: certificate is valid for *.stadt-heilbronn.de, stadt-heilbronn.de, not matrix.stadt-heilbronn.de:443

Synapse version in use is 1.68.0.

To Reproduce Steps to reproduce the behavior:

1. Go to 'https://federationtester.matrix.org/#stadt-heilbronn.de'
2. See error

Expected behavior See version string returned instead of an error.

Screenshots

Desktop (please complete the following information):

• OS: Linux
• Browser: Chrome
• Version: version of what? browser? 105.0.5195.125

Additional context

[richvdh]

Similarly observed on https://federationtester.matrix.org/#matrix.org

[richvdh]

possibly related to https://github.com/matrix-org/matrix-federation-tester/issues/99 ?

[neilalexander]

The problem seemed to be pretty much along the lines of:

1. You enter a domain matrix.org into the federation tester
2. The federation tester asks GMSL to resolve the well-known for matrix.org, gets federation-client.matrix.org:443 back
3. The federation tester then tries to call GetVersion with federation-client.matrix.org:443 instead of matrix.org
4. GMSL then tries to resolve the well-known of federation-client.matrix.org:443(because it isn't expecting the input to be resolved already) and hits the certificate error because matrix-federation.matrix.org:443 isn't present in the certificate SANs
5. Sadness

Should be fixed by #126.

[richvdh]

and hits the certificate error because matrix-federation.matrix.org:443 isn't present in the certificate SANs

but *.matrix.org is. Are you saying the port number is the problem?

[neilalexander]

but *.matrix.org is. Are you saying the port number is the problem?

Yes, because the SAN checking in Go is strict and won't strip the :443 by itself.

[richvdh]

So we think this was introduced by https://github.com/matrix-org/matrix-federation-tester/commit/74aef8875077b5094141d1ffe0b4c5d43bb28e4d, which bumped GMSL: https://github.com/matrix-org/gomatrixserverlib/compare/dd4d53729ead...c71e518537a2, though it's unclear exactly which change introduced this.

[cremesk]

something is wrong with the fed tester.. i try v0.6.. it works with some server_names with others, however, it does not work. eg:

  "ConnectionErrors": {},
  "Version": {
    "error": "contents=[123 10 9 9 9 9 34 101 114 114 99 111 100 101 34 58 32 34 77 95 78 79 84 95 70 79 85 78 68 34 44 10 9 9 9 9 34 101 114 114 111 114 34 58 32 34 72 111 119 32 100 105 100 32 121 111 117 32 101 110 100 32 117 112 32 111 110 32 58 52 52 51 32 119 105 116 104 111 117 116 32 114 101 115 111 108 118 105 110 103 32 116 104 101 32 115 101 114 118 101 114 32 110 97 109 101 63 32 84 104 101 32 100 101 102 97 117 108 116 32 102 101 100 101 114 97 116 105 111 110 32 112 111 114 116 32 105 115 32 56 52 52 56 32 240 159 164 148 34 44 10 9 9 9 9 34 115 111 108 117 116 105 111 110 34 58 32 34 83 116 97 114 116 32 119 105 116 104 32 114 101 115 111 108 118 105 110 103 32 116 104 101 32 46 119 101 108 108 45 107 110 111 119 110 32 102 105 108 101 44 32 97 110 100 32 100 111 110 39 116 32 102 111 114 103 101 116 32 116 104 101 32 83 82 86 32 114 101 99 111 114 100 46 34 44 10 9 9 9 9 34 115 112 101 99 34 58 32 34 104 116 116 112 115 58 47 47 115 112 101 99 46 109 97 116 114 105 120 46 111 114 103 47 118 49 46 51 47 115 101 114 118 101 114 45 115 101 114 118 101 114 45 97 112 105 47 35 114 101 115 111 108 118 105 110 103 45 115 101 114 118 101 114 45 110 97 109 101 115 34 44 10 9 9 9 9 34 240 159 144 136 34 58 32 116 114 117 101 10 9 9 9 125] msg=Failed to GET JSON (hostname \"maunium.net\" path \"/_matrix/federation/v1/version\") code=404 wrapped=M_NOT_FOUND: How did you end up on :443 without resolving the server name? The default federation port is 8448 🤔"
  },
  "FederationOK": false
}

fyi: with v0.4 all works fine.