Recent content by kvic

If you link against openssl 1.1.1, you'll get tls 1.3 features and see this flag on servstats page. 1.1.x may not be available on Raspian yet. You could try to pull it yourself. Do you happen to have written/seen a config guide and perhaps could share with raspiban users (assume u run pinhole...

The first two errors (failed lo load..) seem to tell you've wiped out your Diversion installation? Do you see the files in the dir? Try "ls -l /opt/var/cache/pixelserv/ca*" The last error (abort..) seems to tell your "S80pixelserv-tls" is overwritten by your Entware update actions. Perhaps...

OpenSSL is upgraded to 1.1.x in Entware/Openwrt. I think this is going to upset some of the "automation installers" commonly used on this forum unable to handle unforeseen situations..

Try manual start (and in future if you see similar errors..) /opt/etc/init.d/S80pixelserv-tls restart

Run the below one-liner should fix any errors. _binfavor=static sh -c "$(wget -qO - https://kazoo.ga/pixelserv-tls/install-beta.sh)" This (as mentioned on https://kazoo.ga/pixelserv-tls/) will install the latest statically linked pixelserv-tls binary. There is on-going benefit to run the...

Looks like things in this thread work out very well! Enjoy the refresh from OpenSSL, everyone!

Very interesting and all these seem happen in the past few years..

Previously mentioned in this thread, a gentleman has created a Docker image for pixelserv-tls. I see it has accumulated over 10K+ downloads. I'm a bit shocked. Belated realisation of Docker's popularity these days.

Turned a few knobs, fixed some codes mistakenly merged by UBNT or not merged by UBNT. That's about it. So basically UBNT was doing a lousy job. As an aside, after two years in baking, UBNT released a buggy 2.0.0 FW (at least for the ERX/MediaTek platform though it comes with a newer kernel than...

I tried DNS over TLS in Unbound 1.9.0. Really brief (<10mins). It seems speed-up feature such as session resumption still not available. On a test domain, DNS over TLS to Cloudflare takes 400ms. Plain DNS takes 60ms. Not worth the penalty to me. OpenSSL 1.1.1a won't magically solve this problem.

For those interested in knowing EDNS Client-Subnet, I've done a write up recently, mainly notes for myself but general purpose enough to read (click the previous link). Briefly touched upon why you want your own DNS resolvers too. And in case, you want to enable EDNS Client-Subnet in Unbound...

I said so two years ago: GCM vs CBC Also OpenVPN should be retired, given the choice of much faster IPsec, very light weight and flexible Shadowsocks, and now fast and flexible Wireguard. Thanks for sharing your numbers.

Btw, that means for most ppl wanting to be hassle free should have fls-eu.amazon.co.uk and American equivalent domain whitelisted. But I recall you like experimenting things new.. So perhaps you could spend sometime figuring out or simply whitelist it.

Many months ago when some people reported they could not browse in Amazon app, I tried to reproduce the issue. I tried in apps and browsers. I didn't see browsers on PC hit this domain: fls-eu.amazon.co.uk but Android (and perhaps iOS apps) apps do. Perhaps you could try to figure out where on...

Common slu errors are categorised under uce, uca & etc. Uncommon ones will be logged on LEVEL 2 as you've found out above. Reason(267) very likely means "wrong ssl version number". That I suspect it's caused by non SSL/TLS clients running on some of your LAN devices that are attempting...