[GH-ISSUE #208] onlyoffice-document-server docker image: open ssl outdated for TLSv1.3 #114

Closed
opened 2026-02-26 09:36:33 +03:00 by kerem · 4 comments
Owner

Originally created by @vstoppe on GitHub (Dec 19, 2019).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/208

I have the following docker setup:

  • jwilder/nginx-proxy:alpine
  • jrcs/letsencrypt-nginx-proxy-companion
  • nextcloud 16
  • onlyoffice-document-server

Nextcloud and onlyoffice-document server stopped working together a while after I set the SSL_POLICY=Mozilla-Modern for the nginx-proxy. This enforces a tighter and more modern cryptographic standards for certificates. In this way nginx-proxy users use modern TLSv1.3

The logs showed:

Error: write EPROTO 139840816600896:error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version:../deps/openssl/openssl/ssl/s23_clnt.c:802:

They also showed that onlyoffice could not access the files from nextcloud.

From my workstation I could check:

openssl s_client -connect my.nextcloud.domain.com:443

and it showed nicely all information including:

...
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
...

The same openssl check in my onlyoffice-document-container shows:

CONNECTED(00000003)
139907139602072:error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version:s23_clnt.c:769:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1576762504
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Your docker image is based on

  • Ubuntu 16.04 / xenial and
  • openssl-version is 1.0.2.g

which does not seem to be compatible with TLSv1.3. People who are Using openssl-1.0 are encouraged to upgrade to version 1.1.1 asap.

For the reason of tighter security I want to encourage you to either:

  • upgrade the openssl in your image
  • or base it on (maybe) Ubuntu 18.04 or something else with openssl 1.1.1
Originally created by @vstoppe on GitHub (Dec 19, 2019). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/208 I have the following docker setup: - jwilder/nginx-proxy:alpine - jrcs/letsencrypt-nginx-proxy-companion - nextcloud 16 - onlyoffice-document-server Nextcloud and onlyoffice-document server stopped working together a while after I set the [SSL_POLICY=Mozilla-Modern](https://hub.docker.com/r/jwilder/nginx-proxy) for the nginx-proxy. This enforces a tighter and more modern cryptographic standards for certificates. In this way nginx-proxy users use modern TLSv1.3 The logs showed: ``` Error: write EPROTO 139840816600896:error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version:../deps/openssl/openssl/ssl/s23_clnt.c:802: ``` They also showed that onlyoffice could not access the files from nextcloud. From my workstation I could check: `openssl s_client -connect my.nextcloud.domain.com:443` and it showed nicely all information including: ``` ... Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 ... ``` The same openssl check in my onlyoffice-document-container shows: ``` CONNECTED(00000003) 139907139602072:error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version:s23_clnt.c:769: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 305 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1576762504 Timeout : 300 (sec) Verify return code: 0 (ok) ``` Your docker image is based on - Ubuntu 16.04 / xenial and - openssl-version is 1.0.2.g which does not seem to be compatible with TLSv1.3. People who are Using openssl-1.0 are [encouraged](https://mta.openssl.org/pipermail/openssl-users/2018-September/008706.html) to upgrade to version 1.1.1 asap. For the reason of tighter security I want to encourage you to either: * upgrade the openssl in your image * or base it on (maybe) Ubuntu 18.04 or something else with openssl 1.1.1
kerem closed this issue 2026-02-26 09:36:33 +03:00
Author
Owner

@alexanderonlyoffice commented on GitHub (Dec 21, 2019):

@vstoppe, thank you for the provided information. We will analyze it.

<!-- gh-comment-id:568160123 --> @alexanderonlyoffice commented on GitHub (Dec 21, 2019): @vstoppe, thank you for the provided information. We will analyze it.
Author
Owner

@ShockwaveNN commented on GitHub (Dec 25, 2019):

@vstoppe Hi, we use latest version of openssl for Ubuntu 16.04

We're trying to update base image to Ubuntu 18.04 for 5.5.0 release, but not sure if everything would work fine, so I cannot guarantee ubuntu 18 as base for 5.5.0

<!-- gh-comment-id:568872250 --> @ShockwaveNN commented on GitHub (Dec 25, 2019): @vstoppe Hi, we use [latest](https://packages.ubuntu.com/xenial-updates/openssl) version of `openssl` for Ubuntu 16.04 We're trying to update base image to Ubuntu 18.04 for 5.5.0 release, but not sure if everything would work fine, so I cannot guarantee ubuntu 18 as base for 5.5.0
Author
Owner

@edvinkuric commented on GitHub (Jun 5, 2020):

Hey @ShockwaveNN ,

any progress in updating the image? it's been half a year - this seems important..

<!-- gh-comment-id:639308098 --> @edvinkuric commented on GitHub (Jun 5, 2020): Hey @ShockwaveNN , any progress in updating the image? it's been half a year - this seems important..
Author
Owner

@ShockwaveNN commented on GitHub (Jun 5, 2020):

Hi @edvinkuric
We updated base image to 18.04 in 5.5.0 release, see changelog

And openssl inside image is 1.1.1

dpkg -l | grep openssl
ii  openssl                               1.1.1-1ubuntu2.1~18.04.5            amd64        Secure Sockets Layer toolkit - cryptographic utility

Seems I just forgot to close this issue, as far as I understand it should be resolved, but feel free to comment

<!-- gh-comment-id:639331705 --> @ShockwaveNN commented on GitHub (Jun 5, 2020): Hi @edvinkuric We updated base image to 18.04 in 5.5.0 release, see [changelog](https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#docker-1) And openssl inside image is 1.1.1 ``` dpkg -l | grep openssl ii openssl 1.1.1-1ubuntu2.1~18.04.5 amd64 Secure Sockets Layer toolkit - cryptographic utility ``` Seems I just forgot to close this issue, as far as I understand it should be resolved, but feel free to comment
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#114
No description provided.