Recently upgraded everything to the latest version for HA. Everything has been running fine for a while now. I recently bought a Voice Preview device to try it out. It requires the install of the piper and whisper apps. I cannot install either of these through the UI. Both applications timeout when trying to install. I tried installing another package AirSonos (from ghcr dot io) just to see if it fails on all apps, and this application installed just fine. After some troubleshooting it looks like the TLS handshake between HA and the docker register at registyr-1.docker.io is failing. Supervisor log shows this:
Failed to connect to registry docker dot io: Connection timeout to host https ://registry-1.docker.io/v2/homeassistant/amd64-addon-piper/manifests/latest
Can’t install homeassistant/amd64-addon-piper:… Get “https ://registry-1.docker.io/v2/”: net/http: TLS handshake timeout
I ran a few tests with CURL at the command line to see if I could see what is going on.
curl -4 -vI --connect-timeout 10 https ://registry-1.docker.io/v2/
curl -4 -vI --connect-timeout 10 https ://registry-1.docker.io/v2/
- Host registry-1.docker. io:443 was resolved.
- IPv6: (none)
- IPv4: 98.90.183.39, 44.205.219.111, 54.205.44.123, 98.85.115.1, 54.84.142.142, 184.192.139.247, 100.51.248.20, 52.202.160.116
- Trying 98.90.183.39:443…
- ALPN: curl offers h2,http/1.1
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- SSL Trust Anchors:
- CAfile: /etc/ssl/certs/ca-certificates.crt
- CApath: /etc/ssl/certs
- Connection timed out after 10000 milliseconds
- closing connection #0
curl: (28) Connection timed out after 10000 milliseconds
If I use tls 1.2 or the curve algorithm it works just fine.
curl -4 -vI --connect-timeout 10 --tls-max 1.2 https ://registry-1.docker.io/v2/
curl -4 -vI --connect-timeout 10 --curves X25519 https ://registry-1.docker.io/v2/
I have no custom MTU set. I’m tried a couple of different DNS servers without affect.
Seems to only be a problem where Supervisor/Docker pull official add-on images from registry-1.docker.io. The client’s default TLS 1.3 hello (post-quantum X25519MLKEM768, larger Client Hello) never gets a Server Hello from Hub’s AWS endpoints. And the smaller hello (TLS 1.2 or TLS 1.3 X25519-only) works from the same HA host. GHCR accepts the default hello, so community add-ons still install.
Anyone else seeing this? Or know how to fix this?