Lots of "TLS handshake error"

[timkgh]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to report a bug and not ask a question or ask for help

• I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

Linux, MIPS64 LE

Installation

GitHub releases or script from README

Setup

On a router, DHCP is handled by the router

AdGuard Home version

v0.108.0-b.62

Action

The log file is full of error messages such as:

2025/01/21 23:55:01.424793 [info] tls: number of certs: 1
2025/01/21 23:55:19.076127 [error] http: TLS handshake error from 192.168.1.87:62249: remote error: tls: unknown certificate server=https

The client is an iPad. The AGH server is running on port 8443 and I have encryption enabled because I want the admin interface over https but I don't care for DoH or DoT, just plain DNS53 on the LAN.

This seems to have started with v0.108.0-b.62

Expected result

Do not flood the log file with these messages.

Actual result

Lots of log messages that are not useful.

Additional information and/or screenshots

Can all of these be moved to debug log level instead?

[timkgh]

Lots of these also:

2025/01/20 13:47:05.687710 [error] http: TLS handshake error from 192.168.1.87:49407: EOF server=https

Can all of these be moved to debug log level instead?

[timkgh]

I changed the AdGuardHome ports from the more common 8080 (http) and 8443 (https) to the less common 3080 and 3443. But the iPads still discover port 3443 somehow. Does anyone understand what is going on here? It doesn't look like the iPad is doing any port scanning, so how does it know to try a TLS connection on AGH's port 3443?

It seems to send 6 requests every 30-60 minutes.

I believe remote error: tls: unknown certificate comes from the client because I use a self-signed TLS certificate and for good reason the iPad shouldn't accept it.

I am not trying to make DoH work (I don't care for it on the LAN), I just want the admin interface over https.

[timkgh]

Mystery solved. Apparently AGH advertises DoH via a SVCB record, I assume this is how the iPads discover the "secret" port.

> q _dns.resolver.arpa SVCB
_dns.resolver.arpa. 10s SVCB 1 router. alpn="h2" port="3443" dohpath="/dns-query{?dns}"