Suppress errors on self-signed cert `TCP handshake failed`

[XChikuX]

My HAProxy server at (10.9.9.3) load balances between several servers. I also terminate SSL from cloudflare here while my internal https requests are still served via a self-signed cert.

[INFO] TCP handshake failed with error: TlsAcceptError { error: Os { code: 104, kind: ConnectionReset, message: "Connection reset by peer" }, peer_addr: 10.9.9.3:54800 }

Is there a way to suppress these errors without affecting the rest of the app?

[gi0baro]

I guess you can change the log level to be less verbose just for granian logger.

[XChikuX]

@gi0baro Granian is not too verbose outside of this one though. I'd like to keep the rest of the info logs

[gi0baro]

I guess we could change those logs to be only in debug level, but I need to think more about it. People might rely on those log lines.

[XChikuX]

Changing to debug would help!

It's unlikely anyone is exposing a granian endpoint directly.

It is likely via a cloud provider that auto-provisions SSL certs for the end user. In that scenario the user will always be behind a proxy such as the setup I have going on. Likely without turning on SSL at all.

Insecure -> Cloud Proxy -> Internet.

There is in fact no security issue on the server side from using a self-signed cert (assuming the pk hasn't been blatantly posted online and uses a modern encryption signing standard). It is more of a benefit for the client connecting to the server to know it is part of a trusted PKI group. The real security issue being, a compromised cert has not been withdrawn via a CRL (certificate revocation list) and continues to function as if everything is fine. And as you'd know no-one can catch this, including granian

For reference purposes, uvicorn does not throw any logs for self-signed vs legitimate cert.

So I don't see the issue from my end. If you can think of one, do let me know.

[gi0baro]

@XChikuX I think you're misunderstanding that logline. The message is not about certificates, but the upstream aborting the connection.

[XChikuX]

Oh I see. However, my upstream seems to work fine.

Are you sure the error isn't misplaced? I'll have to see if each request is partially getting dropped.

However when I tested without haproxy on my Dev machine, I didn't see any drops. Just the tsl warning for self-signed.

[XChikuX]

@gi0baro Have you had sometime to think about this?

My backend logs just look like this: