Add --tls-ext to the sstpc invocation
ktosiek opened this issue · comments
This option enables TLS SNI - an extension that makes it possible to have multiple certificates on one IP.
This should be harmless, as the additional information won't be send if the server doesn't advertise support, but it makes for some cryptic disconnects when it's not there:
sty 22 20:24:39 ktosiek-laptop sstpc[28490]: Unrecoverable SSL error -1
sty 22 20:24:39 ktosiek-laptop sstpc[28490]: HTTP handshake with server failed
The above can be replicated by trying to connect to vpn.dcs.pl, which requires SNI, with sstpc.
One can also check with openssl s_client -connect vpn.dcs.pl:443 - the client will get the server certificate, and then fail. But it works with openssl s_client -connect vpn.dcs.pl:443 -servername vpn.dcs.pl.
I'm not sure if this is related to specific version of Windows or something else in our network, I'll talk to the people managing this server tomorrow.
I was told that the server is using mostly default settings, and that there's no proxy in front of it.
This should be fixed now