The latest version of the client doesn't connect to the servers

[arshanskiyav]

Hi.

Server1:
1 cores / 1Gb / Ubuntu LTS 22.04 / Trusttunel 1.0.33 / hoster A / location EE (Tallin) / domain A and LE certificate

Server2:
2 cores / 6Gb / Ubuntu LTS 22.04 / Trusttunel 1.0.33 / hoster B / location EE (Narva) / domain B and LE certificate

Clients:

• Redmi note 9 pro (android 12), app version 1.1.1, Location ME
• huawei p20 pro (android 10), app version 1.1.1, Location ME
• Realmi (android 15), app version 1.1.1, Location RU
• Realmi 12 (android 15), app version 1.1.1, Location RU
• Iphone 16 pro max (ios 26.4.2), app version 1.1.1, Location RU
• PC Windows 10 Pro, app version 1.0.49, Location RU

Since last week, mobile clients have stopped connecting to Server1. I reinstalled the apps and the server, but the problem persists. I installed a new instance on Server2 and the problem persists.

PC clients connected without problems.

I enabled logging (trace) and received the "tls handshake eof" error. I tested this using HTTP2 and QUIC protocols.

Server1 log

09:57:47.067980 [ThreadId(1)] [DEBUG] [trusttunnel::core] [CLIENT=44] New TCP client: 77.222.24.149:9964
09:57:47.068636 [ThreadId(1)] [TRACE] [trusttunnel::core] [CLIENT=45] Accepting TCP connection
09:57:47.068782 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=44] Starting TLS handshake
09:57:47.084100 [ThreadId(2)] [TRACE] [rustls::server::hs] we got a clienthello ClientHelloPayload { client_version: TLSv1_2, random: 5cb3d50a068a05edba230524012b9f18867bec837d56d234f092ca42c08b9454, session_id: a9a61a3ed4dff66161af24103d1eb042165b15c7bfb32d7df20b4d58b92134bd, cipher_suites: [CipherSuite(0x1a1a), TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS13_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, CipherSuite(0x9c), CipherSuite(0x9d), CipherSuite(0x2f), CipherSuite(0x35)], compression_methods: [Null], extensions: ClientExtensions { server_name: SingleDnsName(DnsName("quasar.domain.com")), certificate_status_request: Ocsp(OcspCertificateStatusRequest { responder_ids: [], extensions:  }), named_groups: [NamedGroup(0x6a6a), X25519MLKEM768, X25519, secp256r1, secp384r1], ec_point_formats: SupportedEcPointFormats { uncompressed: true }, signature_schemes: [ECDSA_NISTP256_SHA256, RSA_PSS_SHA256, RSA_PKCS1_SHA256, ECDSA_NISTP384_SHA384, RSA_PSS_SHA384, RSA_PKCS1_SHA384, RSA_PSS_SHA512, RSA_PKCS1_SHA512], protocols: [ProtocolName(6832), ProtocolName(687474702f312e31)], extended_master_secret_request: (), certificate_compression_algorithms: [Brotli], session_ticket: Request, supported_versions: SupportedProtocolVersions { tls13: true, tls12: true }, preshared_key_modes: PskKeyExchangeModes { psk_dhe: true, psk: false }, key_shares: [KeyShareEntry { group: NamedGroup(0x6a6a), payload: 00 }, KeyShareEntry { group: X25519MLKEM768, payload: e2a843a26b33e5006c2ad82607a484ae0379e134630d88afc447c16375bce28bb92644aec0132e50505517301dd8b914bef3888647bee461472be8507bc663eef487783158eeb9996c02b1157666b2cc5e249b86feeb400064521e4b50e1f84f1502391279be7433b97b57a5f159c5551462852136de2b7e7de3a5b3d32c5d3859376734dca1ce39886376cc1355736a366b757ada940be247faf7c731107a91f646e045b88e2972155abcf342b6d21819decc03575b21c7b7c3513c86dc4175db3c844ecab119d77d65b4050c60a744e631a712274918b5db3232640c1f2ce279e27545f06266476040a6f81ba7e88097322eda9a025b0c4553858c041a1ee6aa01d70580f71bbb675853f2fb085b517115f292d6b92c9e0856a2244101ca57adf24a3812b945033fdbeb3bd56808c94483d6b97449780bcef79f8b5ab5e5cb0212f2871c463001e30742c0a1f02759ca1054088b26ca8482258aa3c561a66e1cb758807c64418f392024f84b16a6b86d5844c52dd135ab560a217185b27896f44c7198a220f2046076a5ab9cb816ae0b810de1c4c6eb2db24496bae7047720606e40b23a168ebb94260fe05c2cd51d5f657bbca28f809bc4e9223310927ca66641a5e04eb3345db7c56b386637cf8826f188103114912dbb71822a00318901b8d00a5ec96c37113ef422414bf044dfd3a12a7356edcb695ed0762500a635c19450271ae6f57fb12c49c58cc9e9e4a9d4156544090ab0172ac79302e7c463f4268b47d0bcf34567c0011626e7368634b37d28bdec991b2a08298a295877a4c329e119a18408b7c8ce5a86295068c81487b6596c5b23f546fd27b03c9724c6094bcb665cc8f218c43b2f0f48cf947740bc799101d7069cfb18d17086118c0313c78b1d172abce94abba603f8241da47c7dd64b3d0623326ff175b6db6b05aa8adfea50d890313399418a3a618f4b6d844c6827f972d5e050132992820abd8e381cfd78c79aa46805555c2547a27b774f6ae806e4e99629eb4bd76270a62747991849119620029141d0fc64ad6b532a1b9173283a20a8569f56054de15c935911003ca013387fc8fb5f251126c2811a01e981c4b352baf261058c5ce649c4e5856bd2fa57f4011d6bfb606670085893404381c469a0c15ceab4ec6a88bf6bb76f554c12ab0cc395c9d1a4341b245cd0253a1d6805158aad082842a128550b8c37e5d6bd7a680f3f503229826f85339943655cdf041a4f70367455abe5498f548c692cb36b85593382d21249c61388b378df29c9e46929d1864a1e9c246dc85794d09993122ee38611418b3cce8bc0ccf220295a8691e305bc2abd1e206bd93a13fd721e4e504941e4a8da72020e505a4f90c467812c73d5a1b188289cf15639059b2d34072dd5c480061767f520b6e162f4d73454c5688526a06447389778a84e8467100b87978ba0e74c4353c0a130ea45835960119602eb83a58523b30d0942ddea2ff4bb4f5bca0699b20509084f054c68fa96a53aca5123b769c390268dd8b0c8e6ad49956c4a1651ddc481eaf429dfa4a497159251c10d23177d9ab8811f1ab02179a3cbb384cb34535ddb7682ec1601cb81abb7405e1a0674492433a54ed600c6098ef7c39363d91691c58a2bcaee186cddfdf58468ccf44e48a2bdfbe47f4e8e9b7199331addd521cc6d728e626adc4f87f759a0e5ff7abd3f9494eb49 }, KeyShareEntry { group: X25519, payload: a06cf46a3016f07a7474157cc7b8cb9abd0dc4f8a47e1332a97d4e0f63b7bb01 }], renegotiation_info: , encrypted_client_hello: Outer(EncryptedClientHelloOuter { cipher_suite: HpkeSymmetricCipherSuite { kdf_id: HKDF_SHA256, aead_id: AES_128_GCM }, config_id: 230, enc: 88ab612fb336bb4e6d38757e0d1106d4edfbbaaedec22ab94e51c8c2e13b8d7f, payload: 6dbfc9e3ff889583529f075bcb7daff9a2746e39bdcce04e519f6732e3618c9cc7d63e05426b77c24d65ffe373d33569c27faf5965a304862c7919acd16eba5e913047fde77c434a662e85307294e595261ca01db47279fe3533b1b75d67c9e61a86db34d3bff74378ea9e6efd7685733aa801a6f92dbafe395ea0326846bdc28163cd791863a00dd785d667cfd792c0 }), order_seed: 0, contiguous_extensions: [], .. } }
09:57:47.084365 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=44] TLS handshake complete, processing connection
09:57:47.084390 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=44] Processing TLS connection from 77.222.24.149
09:57:47.084401 [ThreadId(2)] [TRACE] [rustls::server::server_conn] Accepted::client_hello(): ClientHello {
    server_name: Some(
        DnsName(
            "quasar.domain.com",
        ),
    ),
    signature_schemes: [
        ECDSA_NISTP256_SHA256,
        RSA_PSS_SHA256,
        RSA_PKCS1_SHA256,
        ECDSA_NISTP384_SHA384,
        RSA_PSS_SHA384,
        RSA_PKCS1_SHA384,
        RSA_PSS_SHA512,
        RSA_PKCS1_SHA512,
    ],
    alpn: Some(
        [
            ProtocolName(
                6832,
            ),
            ProtocolName(
                687474702f312e31,
            ),
        ],
    ),
    server_cert_types: None,
    client_cert_types: None,
    cipher_suites: [
        CipherSuite(0x1a1a),
        TLS13_AES_128_GCM_SHA256,
        TLS13_AES_256_GCM_SHA384,
        TLS13_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        CipherSuite(0x9c),
        CipherSuite(0x9d),
        CipherSuite(0x2f),
        CipherSuite(0x35),
    ],
    certificate_authorities: None,
    named_groups: Some(
        [
            NamedGroup(0x6a6a),
            X25519MLKEM768,
            X25519,
            secp256r1,
            secp384r1,
        ],
    ),
}
09:57:47.086629 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=44] TLS SNI: __stripped__.domain.com
09:57:47.086666 [ThreadId(2)] [DEBUG] [trusttunnel::core] [CLIENT=44] Connection allowed by filtering rules
09:57:47.086715 [ThreadId(2)] [TRACE] [rustls::server::server_conn] Accepted::client_hello(): ClientHello {
    server_name: Some(
        DnsName(
            "quasar.domain.com",
        ),
    ),
    signature_schemes: [
        ECDSA_NISTP256_SHA256,
        RSA_PSS_SHA256,
        RSA_PKCS1_SHA256,
        ECDSA_NISTP384_SHA384,
        RSA_PSS_SHA384,
        RSA_PKCS1_SHA384,
        RSA_PSS_SHA512,
        RSA_PKCS1_SHA512,
    ],
    alpn: Some(
        [
            ProtocolName(
                6832,
            ),
            ProtocolName(
                687474702f312e31,
            ),
        ],
    ),
    server_cert_types: None,
    client_cert_types: None,
    cipher_suites: [
        CipherSuite(0x1a1a),
        TLS13_AES_128_GCM_SHA256,
        TLS13_AES_256_GCM_SHA384,
        TLS13_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        CipherSuite(0x9c),
        CipherSuite(0x9d),
        CipherSuite(0x2f),
        CipherSuite(0x35),
    ],
    certificate_authorities: None,
    named_groups: Some(
        [
            NamedGroup(0x6a6a),
            X25519MLKEM768,
            X25519,
            secp256r1,
            secp384r1,
        ],
    ),
}
09:57:47.086776 [ThreadId(2)] [DEBUG] [trusttunnel::core] [CLIENT=44] Connection meta: ConnectionMeta { sni: "quasar.domain.com", protocol: Http2, channel: Tunnel, sni_auth_creds: None }
09:57:47.086802 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=44] Accepting TLS connection with protocol Http2
09:57:47.087167 [ThreadId(2)] [TRACE] [rustls::server::hs] Resolving server certificate: ClientHello {
    server_name: Some(
        DnsName(
            "quasar.domain.com",
        ),
    ),
    signature_schemes: [
        ECDSA_NISTP256_SHA256,
        RSA_PSS_SHA256,
        RSA_PKCS1_SHA256,
        ECDSA_NISTP384_SHA384,
        RSA_PSS_SHA384,
        RSA_PKCS1_SHA384,
        RSA_PSS_SHA512,
        RSA_PKCS1_SHA512,
    ],
    alpn: Some(
        [
            ProtocolName(
                6832,
            ),
            ProtocolName(
                687474702f312e31,
            ),
        ],
    ),
    server_cert_types: None,
    client_cert_types: None,
    cipher_suites: [
        CipherSuite(0x1a1a),
        TLS13_AES_128_GCM_SHA256,
        TLS13_AES_256_GCM_SHA384,
        TLS13_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        CipherSuite(0x9c),
        CipherSuite(0x9d),
        CipherSuite(0x2f),
        CipherSuite(0x35),
    ],
    certificate_authorities: None,
    named_groups: Some(
        [
            NamedGroup(0x6a6a),
            X25519MLKEM768,
            X25519,
            secp256r1,
            secp384r1,
        ],
    ),
}
09:57:47.087212 [ThreadId(2)] [DEBUG] [rustls::server::hs] decided upon suite TLS13_AES_128_GCM_SHA256
09:57:47.087516 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending server hello Message { version: TLSv1_2, payload: Handshake { parsed: HandshakeMessagePayload(ServerHello(ServerHelloPayload { legacy_version: TLSv1_2, random: 8c1d3c05172829e587b03b3b170575e9c37f19d1bd1065a096a07659aa18df2a, session_id: a9a61a3ed4dff66161af24103d1eb042165b15c7bfb32d7df20b4d58b92134bd, cipher_suite: TLS13_AES_128_GCM_SHA256, compression_method: Null, extensions: ServerExtensions { key_share: KeyShareEntry { group: X25519MLKEM768, payload: a154b2c6e8803b6338495d6d28f1593f3bceb683b01da147613ea6ad308cdb10bca9e8ffef44f8b103e4117cc9eb51e05282839d975524038e3968fa6e042c24b4637555508ae5657eeb9e6cb27eeafbc84c5b0d4397aa5698d91d0dcd27c13f3735ae26821552d15615a53690009d82712abb05e1a3565582e32ee100bf92c11b1e109b8b00957fa5741399c5362fa138cca8250ea885d333285d73bb0f8cc12d56a8fefc951878adef2b5ba3a2c649ec9a4b37f90afe04d37e1fa712f446c0aabed89b0ae3ae64fbdb2771436c5e0be6f2862fe6f8153a17dbad9b1a5ece702cc8e5b007c116d864ab917d6c8812467582218de832185f2a3ff812a5fbcaabd634297d52928dda6d496f27f22d14481ba36b13a1ece4986c52e262bdf119ce7c2d8c8a05cf40d6f1a4760c11aaccbbd6bbaad2ed44bb3a07340fc0700e6014b613ef32988f378d6b7705496051a49a932ffcde1dcea4d27bd85934691680b45b9283186d40b095d33494ae3233e00fe08c330614381e24d50568c1f2eeefc9a501925a7465107e4d3d6c4568eb5fb7afbca520c7e6e08182a04ee462f1c2f45500c3a3d20e7b802a96ae251ea3bbd8f52e8e972746d18ef1c87daf1de818b460a80c337ab98585c5aee46d133dcadcc43594a5ea2e9d2d08579a703fbd4b9e9b37da9d1fe9601797e17fb7b4ab3b99f4bbff816b8e31f34952e492e8de3bcb7421b1bba6b46b4bb875478d6e0cead9a29e098f207456605bd078535a6f397061dcde1c97491e05d128391508b0df6b14e7925b9179da417f4c47de88dcb3265bbb6fdbf206ce3be6c66b3cbdc1e5b031e84b702975eca4b7412b94b9fb56bc75cacac5a14628010c74d1fe742ae13322e000970f44adb2a64dca56918712c7b2583d3dc75c6fd39fb8cd422086ee27cab92599e1a77a4a630dfe7cee20a501613032240dea18f2cdc12a3be8aa37ca1b2efcfcf5ac13ad1d3a8b674144a278c3cbc00bbc6d6e584ea8f003d9b567eef0a2c5d5cd995dec85d484b83b9ee7a743218b7c429dd34f3514701b0ad347ab507a8ea71f24366a3337211f82c4feb2aa525f20adfb4c84ab67655f3b77a8c2addde919e896bafc5a8ce64b806680ab976142d4344712b43b30c264c9b8b019acd181ed4369a349efd439754053b0cc3dc056aba9eac6c6e91e88124cd3c90181e6e34eba127ba781bd7ee866c342b760d10091862f8399f45b30a49efd72a6285575d5358b4ed26869e62a01fab4d846d05600f895b292701850f27174c7646875f7adad2ce497d913b9344d4c265426608745ebaf034c122f109c724249297bea5bb8f7524eb4c8c0daf2038a1cdb8341c9184818a7e5cc6cd7e539cd1bd0612ac345c6129badcef8407710d873760dc789eedf0438ea3b106539ccfa7587b561b02aeccea43574a93b7c21d4d79a9dad86742c4244cacfd4d4accc26336caeb1297519d3e6bcff3ff5935fa4af7369572941c1021b7b5a974a3e4d4340cbb548f1d908572c2b4fc39c7612112e218f10f6e43514e006e948d6baed19cd604a535d5802db3e0df0271c36ca4ed323 }, selected_version: TLSv1_3, unknown_extensions: {}, .. } })), encoded: 020004b603038c1d3c05172829e587b03b3b170575e9c37f19d1bd1065a096a07659aa18df2a20a9a61a3ed4dff66161af24103d1eb042165b15c7bfb32d7df20b4d58b92134bd130100046e0033046411ec0460a154b2c6e8803b6338495d6d28f1593f3bceb683b01da147613ea6ad308cdb10bca9e8ffef44f8b103e4117cc9eb51e05282839d975524038e3968fa6e042c24b4637555508ae5657eeb9e6cb27eeafbc84c5b0d4397aa5698d91d0dcd27c13f3735ae26821552d15615a53690009d82712abb05e1a3565582e32ee100bf92c11b1e109b8b00957fa5741399c5362fa138cca8250ea885d333285d73bb0f8cc12d56a8fefc951878adef2b5ba3a2c649ec9a4b37f90afe04d37e1fa712f446c0aabed89b0ae3ae64fbdb2771436c5e0be6f2862fe6f8153a17dbad9b1a5ece702cc8e5b007c116d864ab917d6c8812467582218de832185f2a3ff812a5fbcaabd634297d52928dda6d496f27f22d14481ba36b13a1ece4986c52e262bdf119ce7c2d8c8a05cf40d6f1a4760c11aaccbbd6bbaad2ed44bb3a07340fc0700e6014b613ef32988f378d6b7705496051a49a932ffcde1dcea4d27bd85934691680b45b9283186d40b095d33494ae3233e00fe08c330614381e24d50568c1f2eeefc9a501925a7465107e4d3d6c4568eb5fb7afbca520c7e6e08182a04ee462f1c2f45500c3a3d20e7b802a96ae251ea3bbd8f52e8e972746d18ef1c87daf1de818b460a80c337ab98585c5aee46d133dcadcc43594a5ea2e9d2d08579a703fbd4b9e9b37da9d1fe9601797e17fb7b4ab3b99f4bbff816b8e31f34952e492e8de3bcb7421b1bba6b46b4bb875478d6e0cead9a29e098f207456605bd078535a6f397061dcde1c97491e05d128391508b0df6b14e7925b9179da417f4c47de88dcb3265bbb6fdbf206ce3be6c66b3cbdc1e5b031e84b702975eca4b7412b94b9fb56bc75cacac5a14628010c74d1fe742ae13322e000970f44adb2a64dca56918712c7b2583d3dc75c6fd39fb8cd422086ee27cab92599e1a77a4a630dfe7cee20a501613032240dea18f2cdc12a3be8aa37ca1b2efcfcf5ac13ad1d3a8b674144a278c3cbc00bbc6d6e584ea8f003d9b567eef0a2c5d5cd995dec85d484b83b9ee7a743218b7c429dd34f3514701b0ad347ab507a8ea71f24366a3337211f82c4feb2aa525f20adfb4c84ab67655f3b77a8c2addde919e896bafc5a8ce64b806680ab976142d4344712b43b30c264c9b8b019acd181ed4369a349efd439754053b0cc3dc056aba9eac6c6e91e88124cd3c90181e6e34eba127ba781bd7ee866c342b760d10091862f8399f45b30a49efd72a6285575d5358b4ed26869e62a01fab4d846d05600f895b292701850f27174c7646875f7adad2ce497d913b9344d4c265426608745ebaf034c122f109c724249297bea5bb8f7524eb4c8c0daf2038a1cdb8341c9184818a7e5cc6cd7e539cd1bd0612ac345c6129badcef8407710d873760dc789eedf0438ea3b106539ccfa7587b561b02aeccea43574a93b7c21d4d79a9dad86742c4244cacfd4d4accc26336caeb1297519d3e6bcff3ff5935fa4af7369572941c1021b7b5a974a3e4d4340cbb548f1d908572c2b4fc39c7612112e218f10f6e43514e006e948d6baed19cd604a535d5802db3e0df0271c36ca4ed323002b00020304 } }
09:57:47.090185 [ThreadId(2)] [DEBUG] [rustls::server::hs] Chosen ALPN protocol ProtocolName(6832)
09:57:47.090199 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending encrypted extensions HandshakeMessagePayload(EncryptedExtensions(ServerExtensions { server_name_ack: (), selected_protocol: SingleProtocolName(ProtocolName(6832)), unknown_extensions: {}, .. }))
09:57:47.090214 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending certificate HandshakeMessagePayload(CertificateTls13(CertificatePayloadTls13 { context: , entries: [CertificateEntry { cert: CertificateDer(0x3082038d30820314a0030201020212064cb6e98672b74a4710ecd3138b40cc0b57300a06082a8648ce3d0403033032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b3009060355040313024538301e170d3236303531313032303735385a170d3236303830393032303735375a301d311b3019060355040313127175617361722e6c65636974616c2e636f6d3059301306072a8648ce3d020106082a8648ce3d03010703420004150921b22a55c9f4b3485653ac2dd510ef5b4812317042f5b6ab883353339f0d83fb89706d36c9ccda4a8dcc83469e8e5031c9544bc27cef29f6dfa0eeb1d7eda382021d30820219300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070301300c0603551d130101ff04023000301d0603551d0e0416041468b93b39b75ccb2da27cae47e51ef5dead6359ca301f0603551d230418301680148f0d13a2f62e7ed1506c3318385d598e237291ca303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f65382e692e6c656e63722e6f72672f301d0603551d110416301482127175617361722e6c65636974616c2e636f6d30130603551d20040c300a3008060667810c010201302d0603551d1f042630243022a020a01e861c687474703a2f2f65382e632e6c656e63722e6f72672f38382e63726c3082010b060a2b06010401d6790204020481fc0481f900f7007600c2317e574519a345ee7f38deb29041ebc7c2215a22bf7fd5b5ad769ad90e52cd0000019e150018fa0000040300473045022067b156768f0450d4e59001e7b5a8b1265d2435dd6b09c7a9f5fefdb05bda570a022100b2513b71b78e618a5c13351c38679603e94217237ba446ea1500cc3952c1aee5007d001a8b9d6b0ffebf81b47939c6d2310a86d6d102d4f046e2182c9de35f5e2625ef0000019e150019dd000800000500115464c504030046304402200d9b10004da9be3f7f8293f6ea669861d763749a9cbb875afd3eca1cec3e6d1b02205bedbd7eb95ada4a19125c89ab93e1f824e4211390844b1cac7ca8d147bf3112300a06082a8648ce3d040303036700306402304d636965cffb279246159147fe10539748674e2909041a54328484817aaf95fc2a45249ab482c05b0fd7c40f9074ad2d023050a16c6499d6d302adec9b075153062acc1fc32e2be4bf0f98993a142a1c717abccde8caa3b19327c5f81cb76ccaee02), extensions: CertificateExtensions { .. } }] }))
09:57:47.090451 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending certificate-verify HandshakeMessagePayload(CertificateVerify(DigitallySignedStruct { scheme: ECDSA_NISTP256_SHA256, sig: 30440220595801c4f587e30b0c6a8ee72e1577e24f8c477aa3860ba62424d5ec3858c43602205f280e91d26f8dbfcc65c016371773197f2015c2cdcc0e18cbeb0b6d1b16b0ff }))
09:57:47.090488 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending finished HandshakeMessagePayload(Finished(b612a77cbb4903ec7c7a8d48ed06f880f61985a2f98d7a7affccd0335956ac6f))
09:57:47.563671 [ThreadId(2)] [DEBUG] [trusttunnel::core] [CLIENT=44] TLS connection failed: tls handshake eof

Server2 log

12:51:14.264372 [ThreadId(1)] [DEBUG] [trusttunnel::core] [CLIENT=12] New TCP client: 99.22.222.222:37696
12:51:14.264652 [ThreadId(1)] [TRACE] [trusttunnel::core] [CLIENT=13] Accepting TCP connection
12:51:14.265892 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=12] Starting TLS handshake
12:51:14.328851 [ThreadId(2)] [TRACE] [rustls::server::hs] we got a clienthello ClientHelloPayload { client_version: TLSv1_2, random: 1950e7566f1439c95eddbc50aa10753d5a0122bf6a682c56067556dfc919df7f, session_id: 7f7a71d5ac46759003635e39924262827550cdc21055687f1727988fa5583bfe, cipher_suites: [CipherSuite(0x2a2a), TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS13_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, CipherSuite(0x9c), CipherSuite(0x9d), CipherSuite(0x2f), CipherSuite(0x35)], compression_methods: [Null], extensions: ClientExtensions { server_name: SingleDnsName(DnsName("zabbix.domain.ru")), certificate_status_request: Ocsp(OcspCertificateStatusRequest { responder_ids: [], extensions:  }), named_groups: [NamedGroup(0xcaca), X25519MLKEM768, X25519, secp256r1, secp384r1], ec_point_formats: SupportedEcPointFormats { uncompressed: true }, signature_schemes: [ECDSA_NISTP256_SHA256, RSA_PSS_SHA256, RSA_PKCS1_SHA256, ECDSA_NISTP384_SHA384, RSA_PSS_SHA384, RSA_PKCS1_SHA384, RSA_PSS_SHA512, RSA_PKCS1_SHA512], protocols: [ProtocolName(6832), ProtocolName(687474702f312e31)], extended_master_secret_request: (), certificate_compression_algorithms: [Brotli], session_ticket: Request, supported_versions: SupportedProtocolVersions { tls13: true, tls12: true }, preshared_key_modes: PskKeyExchangeModes { psk_dhe: true, psk: false }, key_shares: [KeyShareEntry { group: NamedGroup(0xcaca), payload: 00 }, KeyShareEntry { group: X25519MLKEM768, payload: 6910751357c6ef998c2a5ab6ef4c4e99b1a59c820d408cc10b99a11d45b5cad5897efb0afc467466e942e5a42e30b6cffce879b9802209798d1dd3876190137cbb4678170f07f15d7445407f5b160bab3f1abb57551156e916c38478bde1e79bec6748fcd31571dc68ef269db1c90d5fc57267388a6778267b7489107009966a8b575a6899658f4ea526dfdc34600a21c91b2a69e8c4c051a59c46a51b946b8c379f752b9d67ea29e0ac37d50935cbf0296ef95052bb334dd04ec337a7d46394f603b36ce57cc16993d3ec197319cf9f891c14482b1c21588485046ae3148d7a6dd24288b9326c1bf4c722f27eefea9614b408df164140338d65e21af2db0e2d6abe8e30462010660dec1cfdd42fc8d76d9fb36218383a696b228153c89579c7ca2a6c469cb0b724358a61c88072bfffb67cfd5986c6cb8197da6650056d3e2a860f655036b576efb71c7c96a613b90d1cba99d735b9ea6ab44ec7c3775b40da8a2fcb54055bab689bea2aef979c3f718a0f076f32bbc2a5b206c0650544b6bdc83cbb429a1c68d37ecd5c061370b17702176b918eb15c0335467c0a83c56be7a02d51b8a7f017b2d81aea9446439aced6561a32e0c446401914f441774409f4831b1d823cce023a0ee645ef42cb51dcac9abac3944662c79a819e3546dc95b5277205c8c35089571a24707f89900bad1778b323400b1800d4973f0790cdfcd8093c99a4c2666905c2ba4c322b4ac053a3115c0ec600e0713d0ad4361932c0a7c84efb0a0ffa359513f5bb5f94c93f27ae75f94551a7ceae71783988b3ca8504822300e9969bd5cc769341522e4a8303a4158ea2749c535734f6ae69562d82bc333b773574fbcf0ea91f56c802e201c99b6c526fa1a6fb1ccd8716691206112f099a9f6cc8d705bb65e3791f84c65f7b6bd9ca262af609db65c39b973ebaa950ee0363e8905fe3c2a46a6969f1eab6c7f4ad5f41a972742da829ac6c413bdf27465112c2ca7b06d3c399b1362a7248997d86c5f0ba89d6eaa17a146d96d3a3ed71b9e617835e70c08c061204bc2ffc8a98ece0458714702d79b4e40c75eeb426c0f904eca361c19982f770048fac7603e188c008acb0659d9da3cfa5866ba4479784e9a35e8135e424c1a1f49d75381910352a7a91b0a16381ef3ba6b907600ccb424d5a80c58b04e0b598e09b5759660124653870440f6632c9bab3515a4bca47159b034981013694fafc109e1c4605d1840fd23a83a809f50b500fbb25b745584b077bc53631491a9f50aa1c7a18c8cd4cb1ecd4724a297fbeb055f07b594b43a40e870b2a1abdb9854bbb892a73a2bf35346192f977932c235d226819b7b466c7802a827d6a83328f856651167065c732b4c8334f88202ce8c2bc803e24c20f2c4b09f6a37aa78a9a8724a66877640ef956743496aa857910ab3231419ca14641c2a53cdb4cb776e26956d16aafe669143b72f3e82203663a3b901310588980f4ad17e2c7d68a6b9a256ed975b6d3cc1df4249e15235211058fb9c5192c48323c679fdc645cd03ace8f7b953bfca29b2c26fd47142f37a0b576a9a38472b6a5810cb49d2b346f859076cde0956c610d93081a0ee02ea6e79a9d441b6cb603b1940c1b9eace5496513f345a7658b402815a6f539061571991697446c37bf667e1fbc528ad700189efc1f0500e333e6bc807d9189933855588e489f955f7776 }, KeyShareEntry { group: X25519, payload: 108be0a7cd4a6367ff5a63603721e5b60817912725406e9f178ac4307d5e4417 }], renegotiation_info: , encrypted_client_hello: Outer(EncryptedClientHelloOuter { cipher_suite: HpkeSymmetricCipherSuite { kdf_id: HKDF_SHA256, aead_id: AES_128_GCM }, config_id: 73, enc: 76246c3b7f0388f5f63e719b511e1fbbe0b3f864d94e728bb1632dff0744ad11, payload: 750fc5862571ad5c5d288d61bd236c64c1b944c207f1db88c70af9d2edb358bb75f83bdb963d7538934df3d0b77d946eaa677d3620a8ff66b9597930f3183d8cf5e6479404eb8d65de3cb4c4fd796df91677eaf0457f11f705443655590364e890d04e32dd75843703851a0760d4198f50089e5c8a45efcee66cc83a26bd991e5e1feb4d57315eb3e911772cf4d6ea79a962e47ad30b56cbab8108472634e912536ddc630af482b8b43a11a1b4f2637cd06c7ec53e5c9c49306271446355f564a4f093e9169bacba452dc74143ffd075e54e2bc6c98d8b711bb7b85b05e9f6be752fc96a88ea75d64a54e953e77cc3ae }), order_seed: 0, contiguous_extensions: [], .. } }
12:51:14.329496 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=12] TLS handshake complete, processing connection
12:51:14.329543 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=12] Processing TLS connection from 99.22.222.222
12:51:14.329552 [ThreadId(2)] [TRACE] [rustls::server::server_conn] Accepted::client_hello(): ClientHello {
    server_name: Some(
        DnsName(
            "zabbix.domain.ru",
        ),
    ),
    signature_schemes: [
        ECDSA_NISTP256_SHA256,
        RSA_PSS_SHA256,
        RSA_PKCS1_SHA256,
        ECDSA_NISTP384_SHA384,
        RSA_PSS_SHA384,
        RSA_PKCS1_SHA384,
        RSA_PSS_SHA512,
        RSA_PKCS1_SHA512,
    ],
    alpn: Some(
        [
            ProtocolName(
                6832,
            ),
            ProtocolName(
                687474702f312e31,
            ),
        ],
    ),
    server_cert_types: None,
    client_cert_types: None,
    cipher_suites: [
        CipherSuite(0x2a2a),
        TLS13_AES_128_GCM_SHA256,
        TLS13_AES_256_GCM_SHA384,
        TLS13_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        CipherSuite(0x9c),
        CipherSuite(0x9d),
        CipherSuite(0x2f),
        CipherSuite(0x35),
    ],
    certificate_authorities: None,
    named_groups: Some(
        [
            NamedGroup(0xcaca),
            X25519MLKEM768,
            X25519,
            secp256r1,
            secp384r1,
        ],
    ),
}
12:51:14.330321 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=12] TLS SNI: __stripped__.domain.ru
12:51:14.330584 [ThreadId(2)] [DEBUG] [trusttunnel::core] [CLIENT=12] Connection allowed by filtering rules
12:51:14.330604 [ThreadId(2)] [TRACE] [rustls::server::server_conn] Accepted::client_hello(): ClientHello {
    server_name: Some(
        DnsName(
            "zabbix.domain.ru",
        ),
    ),
    signature_schemes: [
        ECDSA_NISTP256_SHA256,
        RSA_PSS_SHA256,
        RSA_PKCS1_SHA256,
        ECDSA_NISTP384_SHA384,
        RSA_PSS_SHA384,
        RSA_PKCS1_SHA384,
        RSA_PSS_SHA512,
        RSA_PKCS1_SHA512,
    ],
    alpn: Some(
        [
            ProtocolName(
                6832,
            ),
            ProtocolName(
                687474702f312e31,
            ),
        ],
    ),
    server_cert_types: None,
    client_cert_types: None,
    cipher_suites: [
        CipherSuite(0x2a2a),
        TLS13_AES_128_GCM_SHA256,
        TLS13_AES_256_GCM_SHA384,
        TLS13_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        CipherSuite(0x9c),
        CipherSuite(0x9d),
        CipherSuite(0x2f),
        CipherSuite(0x35),
    ],
    certificate_authorities: None,
    named_groups: Some(
        [
            NamedGroup(0xcaca),
            X25519MLKEM768,
            X25519,
            secp256r1,
            secp384r1,
        ],
    ),
}
12:51:14.330787 [ThreadId(2)] [DEBUG] [trusttunnel::core] [CLIENT=12] Connection meta: ConnectionMeta { sni: "zabbix.domain.ru", protocol: Http2, channel: Tunnel, sni_auth_creds: None }
12:51:14.330810 [ThreadId(2)] [TRACE] [trusttunnel::core] [CLIENT=12] Accepting TLS connection with protocol Http2
12:51:14.331384 [ThreadId(2)] [TRACE] [rustls::server::hs] Resolving server certificate: ClientHello {
    server_name: Some(
        DnsName(
            "zabbix.domain.ru",
        ),
    ),
    signature_schemes: [
        ECDSA_NISTP256_SHA256,
        RSA_PSS_SHA256,
        RSA_PKCS1_SHA256,
        ECDSA_NISTP384_SHA384,
        RSA_PSS_SHA384,
        RSA_PKCS1_SHA384,
        RSA_PSS_SHA512,
        RSA_PKCS1_SHA512,
    ],
    alpn: Some(
        [
            ProtocolName(
                6832,
            ),
            ProtocolName(
                687474702f312e31,
            ),
        ],
    ),
    server_cert_types: None,
    client_cert_types: None,
    cipher_suites: [
        CipherSuite(0x2a2a),
        TLS13_AES_128_GCM_SHA256,
        TLS13_AES_256_GCM_SHA384,
        TLS13_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        CipherSuite(0x9c),
        CipherSuite(0x9d),
        CipherSuite(0x2f),
        CipherSuite(0x35),
    ],
    certificate_authorities: None,
    named_groups: Some(
        [
            NamedGroup(0xcaca),
            X25519MLKEM768,
            X25519,
            secp256r1,
            secp384r1,
        ],
    ),
}
12:51:14.331446 [ThreadId(2)] [DEBUG] [rustls::server::hs] decided upon suite TLS13_AES_128_GCM_SHA256
12:51:14.332170 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending server hello Message { version: TLSv1_2, payload: Handshake { parsed: HandshakeMessagePayload(ServerHello(ServerHelloPayload { legacy_version: TLSv1_2, random: a322a5ad25b816fcb9999b01d37cce132b34d5f782f2d71d7c1d2ad7be3918e1, session_id: 7f7a71d5ac46759003635e39924262827550cdc21055687f1727988fa5583bfe, cipher_suite: TLS13_AES_128_GCM_SHA256, compression_method: Null, extensions: ServerExtensions { key_share: KeyShareEntry { group: X25519MLKEM768, payload: bd9a3d034b5f4dcfe56f83c7b6322d1ba3dda6519f961dfb2fffed1d33b8cf3382ac9d8f907e00f0fd380e968151a5858bab4f35f0ca6aa9a7d7fe295252b0dcb32bc376fa122aaded6158ee889e894d1c86dafd4ed13325256fc1cdc66fe25ccf786a1e2ef7ef0f35483055baef8e99d38d1d4e598d55cff1a7347d48eb72db208a75ed1545afb1dc6e3a18806ee60dc0f4e565b1f341ba11a24748edc49acd303726107c85c70ec59dca8818a2e13162b73367c89a756005615c6b0033652993598be4e5323803f1d029d207881be6b2f92e663831514e713721a78161db44ff1871238d6face92b208d1f9ecd4418fda76c91b274d04b903328b7e194f4fd5ade4cad3fc40cd83a8f02aed064e49558066ddc6285515deb22e84aa491ad0d29cb1c0c7036189fb0b17f4f8b5917924ed0ab97dbfe0870b69da869434b770db508525443ddfc25b72b459c65b40dce9e0db25ca138c0ea9b03934611043dd54c1870eea9e26004113259dbca4e575f268741e8e305456ea2b7930181216fcdafd0c75c3a4685e411ac421265db849d4a9d4692fabb944562a0677f1ef728da42d6e3db0d414de705c23ced768b243ab02218b654c4977370509811dc27baf5780964240ead305859a13391d126b56f792b9e9baa3a77a53d24ac3c594fe7f0cdf0839e0617a8f5171a7f373b0a84583da980726bdc2db54333be578f336fa5dc0af7912512d96c8e5ee1d18e40e2b1171a2eb51147ade8175913f833216f47b6f485238c7c4817d909b6becd1b28411972d8577d1bb22a834aea9754958d771ae35e46571343c82f4eef3eaa11f2e44acc685ca885f4ffe40d486f4b55f61d33398ffffdf526be23731932c66701714671606f3ea5580480a54f2a0a02bdf41b56cc1f35c8c674700fdfefe054f3dae7ce0246200ceb2d9d65af3aab01f1b0685a453b95bdb68698dae86624e90714967ebb41e72720717a18a0cb612b64fe2dbc6f8a809dc82b4b22c7e1038a3a017f92346fbc4739402ee3174b1b4c9281c7646bbd63747c4bbaf97c6ee670614bd368bdcebf5478d72e6046d08c765430b27d717f3f0d31c17198355468d74d06b912fda1784e429dcd428e270d5377d22ea01fb8a549a31325bccd975a8b6f3a62e44aa1a3fc118b06c453d30a01da7fee399b5d7d867534930685fe732c06e47f1e5b07dbebb0c563d7e5b0169fc47999838d5816a777b61199066abb30fb268dac7a87f977b6bd575e6ee65f4e954268c8ca345b8766f1301d70c2c801d38d595189d0ee5b3a0ec46a35572920794e968af6ed74cdec81fc2200637eedeaba2a80020628dabfc0b30d47118679599d665791081116ac6c9562aa3de4975ee96d42b2cb27806498d2601b1c919d7d446a0a06d94569f92531dfe335ffa5a126b74157939a7dd8b2adc4b6a4a52a69c389c56e07f8f5fb03bd562174687aa640a2471f75e6b10d64ab165433a774b0174f6e7fc01d4f07276574821185f5edef2bd36637d373282e8d5de3294c54c7f998ca812b999041a860fe9fb0400c7f1b001501a30005e04d66b5b3114478f476 }, selected_version: TLSv1_3, unknown_extensions: {}, .. } })), encoded: 020004b60303a322a5ad25b816fcb9999b01d37cce132b34d5f782f2d71d7c1d2ad7be3918e1207f7a71d5ac46759003635e39924262827550cdc21055687f1727988fa5583bfe130100046e0033046411ec0460bd9a3d034b5f4dcfe56f83c7b6322d1ba3dda6519f961dfb2fffed1d33b8cf3382ac9d8f907e00f0fd380e968151a5858bab4f35f0ca6aa9a7d7fe295252b0dcb32bc376fa122aaded6158ee889e894d1c86dafd4ed13325256fc1cdc66fe25ccf786a1e2ef7ef0f35483055baef8e99d38d1d4e598d55cff1a7347d48eb72db208a75ed1545afb1dc6e3a18806ee60dc0f4e565b1f341ba11a24748edc49acd303726107c85c70ec59dca8818a2e13162b73367c89a756005615c6b0033652993598be4e5323803f1d029d207881be6b2f92e663831514e713721a78161db44ff1871238d6face92b208d1f9ecd4418fda76c91b274d04b903328b7e194f4fd5ade4cad3fc40cd83a8f02aed064e49558066ddc6285515deb22e84aa491ad0d29cb1c0c7036189fb0b17f4f8b5917924ed0ab97dbfe0870b69da869434b770db508525443ddfc25b72b459c65b40dce9e0db25ca138c0ea9b03934611043dd54c1870eea9e26004113259dbca4e575f268741e8e305456ea2b7930181216fcdafd0c75c3a4685e411ac421265db849d4a9d4692fabb944562a0677f1ef728da42d6e3db0d414de705c23ced768b243ab02218b654c4977370509811dc27baf5780964240ead305859a13391d126b56f792b9e9baa3a77a53d24ac3c594fe7f0cdf0839e0617a8f5171a7f373b0a84583da980726bdc2db54333be578f336fa5dc0af7912512d96c8e5ee1d18e40e2b1171a2eb51147ade8175913f833216f47b6f485238c7c4817d909b6becd1b28411972d8577d1bb22a834aea9754958d771ae35e46571343c82f4eef3eaa11f2e44acc685ca885f4ffe40d486f4b55f61d33398ffffdf526be23731932c66701714671606f3ea5580480a54f2a0a02bdf41b56cc1f35c8c674700fdfefe054f3dae7ce0246200ceb2d9d65af3aab01f1b0685a453b95bdb68698dae86624e90714967ebb41e72720717a18a0cb612b64fe2dbc6f8a809dc82b4b22c7e1038a3a017f92346fbc4739402ee3174b1b4c9281c7646bbd63747c4bbaf97c6ee670614bd368bdcebf5478d72e6046d08c765430b27d717f3f0d31c17198355468d74d06b912fda1784e429dcd428e270d5377d22ea01fb8a549a31325bccd975a8b6f3a62e44aa1a3fc118b06c453d30a01da7fee399b5d7d867534930685fe732c06e47f1e5b07dbebb0c563d7e5b0169fc47999838d5816a777b61199066abb30fb268dac7a87f977b6bd575e6ee65f4e954268c8ca345b8766f1301d70c2c801d38d595189d0ee5b3a0ec46a35572920794e968af6ed74cdec81fc2200637eedeaba2a80020628dabfc0b30d47118679599d665791081116ac6c9562aa3de4975ee96d42b2cb27806498d2601b1c919d7d446a0a06d94569f92531dfe335ffa5a126b74157939a7dd8b2adc4b6a4a52a69c389c56e07f8f5fb03bd562174687aa640a2471f75e6b10d64ab165433a774b0174f6e7fc01d4f07276574821185f5edef2bd36637d373282e8d5de3294c54c7f998ca812b999041a860fe9fb0400c7f1b001501a30005e04d66b5b3114478f476002b00020304 } }
12:51:14.332485 [ThreadId(2)] [DEBUG] [rustls::server::hs] Chosen ALPN protocol ProtocolName(6832)
12:51:14.332493 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending encrypted extensions HandshakeMessagePayload(EncryptedExtensions(ServerExtensions { server_name_ack: (), selected_protocol: SingleProtocolName(ProtocolName(6832)), unknown_extensions: {}, .. }))
12:51:14.332508 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending certificate HandshakeMessagePayload(CertificateTls13(CertificatePayloadTls13 { context: , entries: [CertificateEntry { cert: CertificateDer(0x3082050c308203f4a003020102021205bba2331ffc62c2572608152c26485109ab300d06092a864886f70d01010b05003033310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310c300a06035504031303523132301e170d3236303231353139333330305a170d3236303531363139333235395a3019311730150603550403130e7a61626269782e70786d782e727530820122300d06092a864886f70d01010105000382010f003082010a0282010100a410424bd8c2c0277c9d96e8b01ab80b303d448db43253a98725832ddfac2b2893b14afaeb678b0c8a49da74a9f19527843f7eac149f85b125d350978884033dac956b8f4be5c9e3eaed572649892e9e543992540c2b38f1d3b355f2d3ea191c3d9c77ffeaf1c0fa98fa0ae5cf0265ab4261bea8659ddc8e5a447d38e2518cc3a224d2e97058e0c2e7677d9bd0126da80ae5749928b1d318862083ab54e67433816360baeaff5c2c8c6bf7124179fc138ef66b638ae157f0a253364077e19f66839b3162ff353e9aad0f486543ef07c5e83d6632abc0675f549014df0c66c33a4238fa7577cc965c7d61b154ef29bb3a8adb02d3228bbfa5336e93209da88f830203010001a38202323082022e300e0603551d0f0101ff0404030205a030130603551d25040c300a06082b06010505070301300c0603551d130101ff04023000301d0603551d0e041604146c68e2c84f3ef61947b0b52d86dd87b4422c1b39301f0603551d2304183016801400b529f22d8e6f31e89b4cad783efadce90cd1d2303306082b0601050507010104273025302306082b060105050730028617687474703a2f2f7231322e692e6c656e63722e6f72672f302d0603551d110426302482127777772e7a61626269782e70786d782e7275820e7a61626269782e70786d782e727530130603551d20040c300a3008060667810c010201302e0603551d1f042730253023a021a01f861d687474703a2f2f7231322e632e6c656e63722e6f72672f34342e63726c3082010e060a2b06010401d6790204020481ff0481fc00fa00770016832dabf0a9250f0ff03aa545ffc8bfc823d0874bf6042927f8e71f3313f5fa0000019c63004e3b0000040300483046022100ef4070f23e4bced7c49cfeaaadff87ed7a4b8983e6d8675ef0a90cdcd71175a4022100c879c74fa17956309ab06783888ac4fe5d1c07f300e20fac5f9ebcf39d8ebee3007f001a8b9d694a5798c899a0ca88bdf48fc0b45660ccc3600d1f71f469ffc7d1aca30000019c63005785000800000500488db7fc040300483046022100e102cd0aa9d39cb4e7b73bcf54f0f9decf770c3e1141e1acbaf3c62ebc8433060221008463c20a069471825a23fe4194cb2a83d19ebce7bba49a3f28aed7be8160bf84300d06092a864886f70d01010b050003820101008a0ddc7981070c3d2503a474b650d96d3a615466bbbee7db5f256c8803d9543c9e701b0c9dbab3137464a9de75dc452146e7fbc9b27dc6a185707c54bcb354ef42d9bc83fb15829c86cb283461feddaf380e63ba1462b0ad0cf323a4e41e0215af620ecc1114a1738c551ecb36ccadb8a628c0f4fbaa2af1f70e9b114bc9a953cd95db1637a4af7962afa392c6a5e1452302737279ea80e34dad6bc58496eb5c20b18eb911557f1af03e6c008a8545a9e373d9e12f74d044264a1734a5104f020397d138057f4584695bf0645063eca8f8ba51f7bc5e1b73da65186da31a06450a2f3d9268a400f51ee4c4308f06c14c7d0fd54b4150c19fd70f41488150abbb), extensions: CertificateExtensions { .. } }] }))
12:51:14.336817 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending certificate-verify HandshakeMessagePayload(CertificateVerify(DigitallySignedStruct { scheme: RSA_PSS_SHA512, sig: 81626ce6ebabb616b50c1f079ade8faeda010b2e8374275aa12182f0d2ddf2cfa7d40fe94e6fee8c6c4c4b67c03314e0fd07d6d5588f360abdb36768561bd4fc910440ba89aa33b2d08aaef7b4d33a8c412f3b0818168feeabff924c4dcdb4e51580fa4cd4ab65498afa1abcb0df38205e0a3ddd8f834fd6f18ea094e5813e1225b7d858b1fd77e2e344d1a2bcf10f14eae06bd8536ceaa6e1dc5e21a71e2cfa0f0f2aa31e37613808a7fd435eb4486771bded1df36a799bea25706becd734a976d4498aa19fe4ff62f3419d25c30f4f227c0c21e56820c14ec1f5d125bd2ea987dbeb499da2fdb1b361519bd4ea29eb49403d44c990e2d966c85546a3dc6d75 }))
12:51:14.336902 [ThreadId(2)] [TRACE] [rustls::server::tls13::client_hello] sending finished HandshakeMessagePayload(Finished(1922f7e3a10e433f625fd1db9c7a0c1097e502f6c3797b66d17dca61ea02b0bb))
12:51:14.860139 [ThreadId(2)] [DEBUG] [trusttunnel::core] [CLIENT=12] TLS connection failed: tls handshake eof

Can you help me solve this problem?

[oksenina]

@arshanskiyav Hello!
Thanks for the logs. Our team is reviewing them now, and we'll get back to you as soon as we have more information

[oksenina]

@arshanskiyav Hello!
We're doing a quick follow-up on this ticket. Could you please confirm if you are still encountering this bug in the latest version?

[arshanskiyav]

@arshanskiyav Hello! We're doing a quick follow-up on this ticket. Could you please confirm if you are still encountering this bug in the latest version?

Hi,you haven't released a new version since then. I've just checked it and can confirm that this bug is present in the latest version.

[anyakushin]

@arshanskiyav Hello!

The client definitely just aborts the connection for some reason but it is hard to say without client logs.

The log exporting is not currently implemented for mobile apps but the version 1.2.0 with this feature will be released soon, so let's wait for it.

Btw, according to the timing, this looks like a client rejects the endpoint's certificate. This will also explain why mobile apps were fine for some time. Please double check that the certs are valid and non-expired. Have you issued the certs using the setup_wizard built-in feature? If so, have you configured the auto-renewal of the issued certs according to the docs?

[arshanskiyav]

@anyakushin , Hello!

I had this issue in May on both old and new instance. I use LE certs and certs are valid. I reissue certs manually and restart trusttunnel service.
I will wait for the new version of the app.