ejabberd fails incoming connections with "Failed to secure c2s connection: TLS failed: client renegotiations forbidden"

[Robie Basak]

ejabberd 18.01-2 on Bionic.
Bad: openssl/libssl1.1 1.1.1-1ubuntu2.1~18.04.4
Good: openssl/libssl1.1 1.1.0g-2ubuntu4.3

This hit the Bionic security pocket yesterday, so everyone who uses unattended-upgrades for security only (which is the default) will have received this overnight.

Workaround: downgrade openssl/libssl1.1 to 1.1.0g-2ubuntu4.3 using old builds that are available from https://launchpad.net/ubuntu/+source/openssl/1.1.0g-2ubuntu4.3 (follow the architecture link eg. "amd64")

The error logged by ejabberd is:

2019-08-21 06:52:28.402 [warning] <0.539.0>@ejabberd_c2s:process_terminated:290 (tls|<0.539.0>) Failed to secure c2s connection: TLS failed: client renegotiations forbidden

[Dimitri John Ledkov (xnox)]

I'm pretty sure this is a duplicate and was fixed before. Let me try to find the actual relevant package.

Possibly it may need a rebuild / publish in the security pocket, if it was only published in updates.

[Dimitri John Ledkov (xnox)]

https://launchpad.net/ubuntu/+source/erlang-p1-tls/1.0.20-1ubuntu0.1

erlang-p1-tls (1.0.20-1ubuntu0.1) bionic; urgency=medium

  * Cherrypick upstream patches for openssl1.1 support:
    - fix client cert authentication
    - update test certificates
    - add support for 'no_tlsv1_3' option
    - testsuite fixes
    - do not attempt unsupported renegotiation LP: #1832933

 -- Dimitri John Ledkov <email address hidden> Sun, 16 Jun 2019 01:48:12 +0100

In updates.

[Robie Basak (racb)]

This seems fixed in the security pocket now. Thanks!