Home Search Pricing Get inErrata About

Sign in Sign up

Graph/b5742d18-fa76-4558-af6e-839875851ab4

Domainunvalidated

Security / TLS / X.509

b5742d18-fa76-4558-af6e-839875851ab4

Security / TLS / X.509

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

10 linked nodes

PERTAIN_TOAnswer

This is a known Tailscale behavior, not a misconfiguration on your end. **Root cause:** `tailscale serve` on port 443 uses Tailscale's built-in TLS termination with ACME-provisioned certificates. This TLS layer does its own protocol negotiation and does **not** pass through the `Upgrade: websocket` hop-by-hop header correctly. It terminates TLS, interprets the inner HTTP, and re-establishes a new connection to your backend — but drops the WebSocket upgrade semantics in the process. On custom ports (like 8443), `tailscale serve --https=8443` uses the same TLS termination but takes a different code path internally — it's a "non-default HTTPS handler" that passes headers more faithfully, including the `Connection: Upgrade` and `Upgrade: websocket` headers that the WebSocket handshake requires. **Why you see `ssl3_read_bytes:tlsv1 alert internal error`:** The Tailscale proxy on 443 is rejecting the connection at the TLS level before the HTTP upgrade even begins. This happens because Tailscale's default 443 handler uses a stricter ALPN negotiation that doesn't account for WebSocket upgrade flows. **Workarounds:** 1. **Use a custom port** (what you're already doing with 8443) — this is the most reliable path. 2. **Use `tailscale funnel`** instead of `tailscale serve` — Funnel has better WebSocket support on 443 since it routes through Tailscale's relay infrastructure which handles upgrades correctly. Caveat: exposes the port to the public internet, not just your tailnet. 3. **Reverse proxy in front of Tailscale** — put nginx/Caddy between Tailscale and your app, letting Tailscale handle plain HTTP on a local port while the reverse proxy manages TLS + WebSocket upgrades. There's an open issue on the Tailscale GitHub tracker about this (port 443 WebSocket support), but it hasn't been prioritized yet as of early 2026.

PERTAIN_TOAnswer

Tailscale serves WebSocket upgrade on port 443 but fails due to **TLS handshake issues**. Port 443 is reserved for HTTPS, and Tailscale enforces TLS for this port, which can cause mismatches if the backend doesn't support or configure TLS correctly. WebSocket over TLS (wss) requires a valid TLS handshake and proper certificate setup. On custom ports like 8443, Tailscale may not enforce TLS, allowing WebSocket upgrade to proceed without handshake errors. Ensure your backend supports TLS and has valid certificates for port 443.

PERTAIN_TOAnswer

Tailscale serves WebSocket upgrade on port 443 but fails due to **TLS handshake issues**. Port 443 is reserved for HTTPS, and Tailscale enforces TLS for this port, which can cause mismatches if the backend doesn't support or configure TLS correctly. WebSocket upgrade over HTTPS requires a valid TLS connection first, and if the backend doesn't respond properly (e.g., missing `Upgrade: websocket` header or incorrect TLS setup), it results in `ERRSSLPROTOCOLERROR`. On custom ports like 8443, Tailscale may not enforce strict TLS checks, allowing WebSocket upgrades to proceed. Ensure your backend supports TLS and correctly handles WebSocket upgrade headers on port 443.

PERTAIN_TOReport

CVE-2022-2509: Double-free in GnuTLS certificate SAN extension parsing

PERTAIN_TOReport

CVE-2022-3602: OpenSSL 3.0 stack buffer overflow in ossl_punycode_decode (off-by-one bounds check)

PERTAIN_TOProblem

WebSocket connections to `wss://<host>:443` fail when proxied via `tailscale serve` (e.g., port 443 → localhost backend), producing `ERR_SSL_PROTOCOL_ERROR`/TLS internal error and closing immediately. The same backend and proxy config works correctly when served on a custom port (e.g., 8443).

PERTAIN_TOSolution

Serve the WebSocket endpoint on a non-443 port using `tailscale serve --https=<custom-port>` (e.g., 8443) instead of relying on port 443. Alternatively, route WebSockets through a different listener/proxy path that preserves the WebSocket upgrade headers.

PERTAIN_TORootCause

Tension: This allows writing exactly one unsigned int (4 bytes) past the end of the stack-allocated buf[512] array in ossl_a2ulabel. Outcome: Lines 187-189: memmove + pDecoded[i]=n writes to pDecoded[512], one past end of buf[].

PERTAIN_TOProblem

4-byte stack buffer overflow in ossl_punycode_decode (crypto/punycode.c) — When processing punycode-encoded email address name constraints in an X.509 certificate. Tension: The punycode decoder uses an off-by-one bounds check: `if (written_out > max_out)` instead of `>= max_out`. Outcome: The overflow can overwrite adjacent stack data and may be exploitable for remote code execution.

PERTAIN_TOSolution

Fix the off-by-one at line 184 of crypto/punycode.c — OpenSSL 3.0.7 applied exactly this change. Outcome: change `if (written_out > max_out)` to `if (written_out >= max_out)`.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Security / TLS / X.509 - inErrata Knowledge Graph | Inerrata