Torrent Indexer TLS Connection Issue

Help & Support
1

Sonarr version (exact version): 2.0.0.4230 Master
Mono version (if Sonarr is not running on Windows):n/a (.Net Framework 4.6.2)
OS: Windows 8.1
((Debug logs)):http://pastebin.com/CmHGPmNs
(Make sure debug logging is enabled in settings and post the full log to hastebin/pastebin/dropbox/google drive or something similar, do not post them directly here)
Description of issue:
Having what appears to be a TLS issue with a torrent indexer - https://hd4free.xyz.

They recently forced https connections, and while I can browse the site just fine and the cert checks out OK, Sonarr won’t connect. The error in pastebin is what was in the logs.

2

Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. The server closed the connection. ((Debug logs)) will show you the exact URL Sonarr connected to so you can see if it does so in a browser as well. Logs that haven’t been truncated may point to something.

3

Just tried it with debug mode on and got this log…
http://pastebin.com/Qpqn5kXZ

I tried the URL that it’s connecting to in my browser and that worked fine and chrome didn’t complain about the cert or anything.

4

SSL Report covers the issue:

https://www.ssllabs.com/ssltest/analyze.html?d=hd4free.xyz

Sonarr (with .net 4.0 installed or mono) effectively behaves like IE8 on Windows XP does, with 4.5 installed its a bit better, though I’m not sure what it equates to, maybe IE 8-10 on Windows 7, but that’s just a guess.

I wrote a quick test app in .net 4.5 that also fails to connect to the server, but one in 4.6.1 works, so the behaviour has changed in .net 4.6.1 which is good because it will work, but bad because we’re not jumping to .net 4.6 anytime soon and I’m not sure if there is a way for us to gain the benefit of 4.6 without actually upgrading (like we get when 4.5 is installed).

I’m not sure if this is something that HD4Free is willing to adjust on their end since their server is terminating it, but we’ll try to see if there is anything that we can do.

EDIT: Looks like we should be able to support this, I’ll confirm after some more testing.

5

I have tried several changes and still not connecting. If you could let me know what needs to changed, I will look into it.

When you say “SSL Report covers the issue” what do you mean? What is the issue?

Thanks
jonnyboy

6

I think that I have the issue resolved.

7

I just tested my Sonarr against https://hd4free.xyz and it now is able to connect. What was the issue?

8

Basically followed Intermediate recommendations:
https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.10.1&openssl=1.0.1e&hsts=yes&profile=intermediate

We were using modern. It is a downgrade, but should still be secure.

Allowing TLS 1,0 and cypher suites below 256bit. This is still secure, for now. At least SSL Labs is not reporting any vulnerabilities.

1 Like
9

Awesome thanks for fixing it on your side! We should be able to fix it on our end as more sites more to more secure connections by default, but this takes away some of the urgency.

EDIT: Opened a PR for the changes on the Sonarr side: https://github.com/Sonarr/Sonarr/pull/1424/files

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.