SSL error on android when using pfsense

[zwiebelspaetzle]

I've recently started getting SSL errors when trying to download certain podcasts from an android device. This doesn't happen on my mac computer, but does on android devices. The problem doesn't occur when downloading via mobile network.

For example, when I try to download https://www.podtrac.com/pts/redirect.mp3/pdst.fm/e/chtbl.com/track/28D492/traffic.megaphone.fm/SLT6080998271.mp3, I get the following error in my podcast app:

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

If I copy the url to a browser, I get:

ERR_SSL_KEY_USAGE_INCOMPATIBLE

I've turned off suricata and pfblocker. I've also tried using both the default webconfigurator cert and a letencrypt (via acme) cert in System->Advanced->Admin Access->SLL/TLS Certificate, but the problem persists.

How can I fix this problem?

[stephenw10]

Nothing to do with pfSense, the host serving that is using a bad cert it looks like.

Your Mac probably shouldn't allow it.

Steve

[stephenw10]

@zwiebelspaetzle said in SSL error on android when using pfsense:

traffic.megaphone.fm/SLT6080998271.mp3

Mmm, something in the redirect since that direct link works.

[zwiebelspaetzle]

@stephenw10 That's what I thought at first, but when I disconnect from wifi and use mobile data, it works. Makes me think that SSL is breaking within pfsense. Maybe some version disagreement between Java on Android and pfsense.

[stephenw10]

pfSense does nothing to that connection by default. Unless you're running Squid that traffic is just routed.
I can only imagine it connects differently via mobile data, to a different server perhaps.

I assume your Mac is also behind pfSense? But how is that connecting, to the same server?

Steve

[SteveITS]

@zwiebelspaetzle Mobile could be IPv6, could be a different web server entirely as they have multiple IPv4s.

https://www.ssllabs.com/ssltest/analyze.html?d=www.podtrac.com&s=44.239.236.149&hideResults=on&latest looks pretty good but does show "Chain issues Incorrect order, Contains anchor". If the client had an issue with that, I would expect it to be a problem regardless of connection...but again could be different web servers.