XA2 stuck on old 4.30.12 OS version: "SSL handshake failed"

Bug Reports
#1

REPRODUCIBILITY: Always
OS VERSION: 4.3.0.12
HARDWARE: Sony Xperia XA2, Model H3113
UI LANGUAGE: English
REGRESSION:

DESCRIPTION:

No software upgrade to 4.4.0 available from 4.3.0; Settings > System > Sailfish OS updates shows old Version 4.3.0.12 and Up to date.

PRECONDITIONS:

None that I am aware of

STEPS TO REPRODUCE:

  1. Go to Settings > System > Sailfish OS updates

EXPECTED RESULT:

Offers to upgrade the device software to available 4.4.0

ACTUAL RESULT:

Shows old Version 4.3.0.12 and incorrectly states Up to date.

MODIFICATIONS:

None that I am aware of.

ADDITIONAL INFORMATION:

  • Settings > Accounts > Jolla shows Account status Active, and I can install apps from the Jolla Store.
  • Opening the Jolla Store app and going to My apps, it says You do not have any installed apps which is not true. Opening Settings > Apps, my installed native (non-Android) apps are all greyed out.
  • Settings > System > Time and date is set to Automatic update.
  • Opening the terminal application and running devel-su in Developer Mode to get into superuser mode,
    ** df -h shows that I have ~450MB available under /opt.
    ** more /var/log/systemupdate.log has its last entries from Nov 10, 2021 and no obvious errors.
$ ssu release
Device release is currently: 4.3.0.12
$ version --dup
NO UPDATES FOUND. Try again later.
$ ssu re 4.4.0.68
Changing release from 4.3.0.12 to 4.4.0.68
Your device is now in release mode!
$ ssu up
Device is not registered, can't update credentials
$ ssu register
Username: REDACTED
Password:
Last operation failed:
SSL handshake failed
$ ssu domain
Device domain is currently: sales
$ rpm -q ca-certificates
ca-certificates-2020.2.41-1.4.1.jolla.noarch

I’d love to know what’s going on and how to debug/fix further, to get and install the Sailfish OS 4.4 update (and be able to uninstall native apps).

Community meeting on IRC 27th October 2022
Community meeting on IRC 10th November 2022
#2

May I ask you to edit your topic and use the awesome template ?
It helps us a lot. In fact, it saves us a lot of time.

In the future, you can even install an application to fill in your bug report.

2 Likes
#3

Of course, done now.

1 Like
#4

Do you get the same behaviour using mobile data? The only case I see, is that you’re connected on a open WiFi and need to confirm your connection.

#5

I am not connected to an open WiFi and there are no wifi portals involved.
The problematic behavior remains the same, both in UI and terminal, after changing “Check for updates” from “WLAN only” to “Always” under “Preferences > System > Sailfish OS updates”, and disabling WiFi and enabling mobile data on the phone.

#6

I also manually upgraded the ca-certificates package from 2020.2.41-1 to 2021.2.50-3 but the problem remains, so it’s not related to local certificates.

#7

It’s not the solution, but this topic may give you some hints. At least which packages you should reinstall.

#8

I am not at all sure ssu up and ssu register are related to OS upgrades.
So maybe that test case/steps are not applicable.

So just to get the obvious out of the way:

  1. This is a paid-for/licensed installation?
  2. Is the account, or has it ever been, registered for the EA program?
#9

This is a licensed installation - I paid before installing it (and I’m not aware that I’d have to pay regularly, though I’d be willing to do so) plus updates worked beforehand from 3.x to 4.3.

If EA stands for Early Access, then I never registered for the Early Access program, no.

1 Like
#10

@acko, you should not use ssu up and / or ssu register, because both are addressing ssu-features Jolla does not utilise. Mind that ssu (“Seamless Software Updater”) is much older than Jolla, it was originally implemented at Nokia in the 2000s, IIRC.

Side note: May I suggest to use sfos-upgrade, because it prevents quite some potential mishaps and might have prevented this one. Or the GUI updater in SailfishOS’ Settings app, as you use a licensed SailfishOS, if upgrading SailfishOS at the command line is not necessary. Jolla’s guidance is to resort to upgrading at the command line when their GUI updater failed.

2 Likes
#11

@olf Please see the steps to reproduce in the initial post. I did try to use the GUI updater in the Settings app. It shows no updates available. Exactly, “Jolla’s guidance is to resort to upgrading at the command line when their GUI updater failed”. That’s where I am.

#12

So nobody has an idea how to debug the “SSl handshake failed” issue? Or how to get debug spew output why my system does not see any updates? There must be some way to debug such issues, shouldn’t there be?

#13

While that message may hint at something broken, the steps to reproduce (the later ones) above are irrelevant because they are wrong: ssu register is not something one needs to do when trying to update.

Please use ssu re to set the version back to the installed version, reboot and then try either the GUI updater, or version --dup, or the best option, sfos-upgrade.

If you want to use only the official CLI tool, the correct sequence is:

$ ssu re 4.4.0.68
$ version --dup

You never did the update/dup step after changing the release (at least from the into given above).

To verify that your openssl configuration is okay, you can try this:

 devel-su pkcon install openssl
 openssl s_client -connect releases.jolla.com:443  < /dev/null

You should get something like this:

---
SSL handshake has read 5477 bytes and written 384 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
DONE
2 Likes
#14

Thanks, devel-su pkcon install openssl was the hint that I was looking for.

In any case, using olf’s sfos-upgrade allowed me to get from 4.3.0.12 to 4.3.0.15 and then 4.4.0.72. I lost Android app support and thus several apps, but at least have an up-to-date underlying OS. Big thanks!

#15

Sounds good, congrats! :slight_smile:

That just installs some tools. There is another package, openssl-libs which has all the necessary libraries, and that has been installed for sure.

1 Like
#16

Thanks for your original report @acko. I’m sorry that you ran into problems but also glad that you managed to get it resolved, with all of the excellent advice from everyone here.

As it’s resolved I’ll go ahead and close this topic, but if anyone wants to add anything later, please send me a direct message and I can reopen it for you.

#17