[GH-ISSUE #2901] Why does the program insist on connecting to gw.amnezia.org? #1320

New issue

Open

opened 2026-10-13 20:40:08 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 20:40:08 +00:00

Owner

Originally created by @gilgamaze on GitHub (Jul 29, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2901

I tried version 5.0.0.5 4d28f81 on Linux. Got the following in my log:

QIODevice::read (QNetworkReplyHttpImpl): device not open
CryptoUtils::decryptAes256Cbc EVP_DecryptFinal_ex failed: "error:030000A9:digital envelope routines::unknown option"
failed to decrypt the data
qt.tlsbackend.ossl: QSslSocket: cannot resolve EVP_PKEY_param_check
qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_new_null
qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_push
qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_free
qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_num
qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_pop_free
qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_value
qt.tlsbackend.ossl: QSslSocket: cannot resolve SSL_CTX_set_options
qt.tlsbackend.ossl: QSslSocket: cannot resolve SSL_session_reused
qt.tlsbackend.ossl: QSslSocket: cannot resolve SSL_set_options
qt.tlsbackend.ossl: Incompatible version of OpenSSL (built with OpenSSL >= 3.x, runtime version is < 3.x)
qt.network.ssl: The backend "cert-only" does not support QSslKey
qt.network.ssl: Active TLS backend does not support key creation
qt.network.ssl: The backend "cert-only" does not support QSslKey
qt.network.ssl: Active TLS backend does not support key creation
qt.network.ssl: The backend "cert-only" does not support QSslKey
qt.network.ssl: Active TLS backend does not support key creation
qt.network.ssl: The backend "cert-only" does not support QSslKey
qt.network.ssl: Active TLS backend does not support key creation
qt.network.ssl: The backend "cert-only" does not support QSslKey
qt.network.ssl: Active TLS backend does not support key creation
qt.network.ssl: The backend "cert-only" does not support QSslKey
qt.network.ssl: Active TLS backend does not support key creation
qt.network.ssl: The backend "cert-only" does not support QSslSocket
qt.network.ssl: The backend named "cert-only" does not support TLS
qt.network.ssl: QSslSocket::connectToHostEncrypted: TLS initialization failed
0
go to the next storage endpoint

My SSL backend is:
SSL backend: OpenSSL 3.5.3 16 Sep 2025

I get OpenSSL 3.0.13 30 Jan 2024 when I run the command
strings /opt/AmneziaVPN/client/lib/libcrypto.so.3 | grep "OpenSSL "

Prior to the latest Amnezia release(5.0.0.5) the program always used to try and make a connection to gw.amnezia.org on port 80 which I have permanently blocked on my firewall. And, things used to work probably because it chose to use a different endpoint.

This is no longer possible with 5.0.0.5. I don't believe I'm being unreasonable by blocking unencrypted HTTP connections. Also seeing gw.amnezia.org in my logs is a dead giveaway that I'm using a VPN and which one in particular.

Could the libraries that come with 5.0.5 and earlier versions be too old? In my case on Linux they're located in /opt/AmneziaVPN/client/lib

I could be wrong, but it appears to me these outdated libraries are the reason the program tries to make a connection on port 80.

Originally created by @gilgamaze on GitHub (Jul 29, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2901 I tried version 5.0.0.5 4d28f81 on Linux. Got the following in my log: ``` QIODevice::read (QNetworkReplyHttpImpl): device not open CryptoUtils::decryptAes256Cbc EVP_DecryptFinal_ex failed: "error:030000A9:digital envelope routines::unknown option" failed to decrypt the data qt.tlsbackend.ossl: QSslSocket: cannot resolve EVP_PKEY_param_check qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_new_null qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_push qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_free qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_num qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_pop_free qt.tlsbackend.ossl: QSslSocket: cannot resolve OPENSSL_sk_value qt.tlsbackend.ossl: QSslSocket: cannot resolve SSL_CTX_set_options qt.tlsbackend.ossl: QSslSocket: cannot resolve SSL_session_reused qt.tlsbackend.ossl: QSslSocket: cannot resolve SSL_set_options qt.tlsbackend.ossl: Incompatible version of OpenSSL (built with OpenSSL >= 3.x, runtime version is < 3.x) qt.network.ssl: The backend "cert-only" does not support QSslKey qt.network.ssl: Active TLS backend does not support key creation qt.network.ssl: The backend "cert-only" does not support QSslKey qt.network.ssl: Active TLS backend does not support key creation qt.network.ssl: The backend "cert-only" does not support QSslKey qt.network.ssl: Active TLS backend does not support key creation qt.network.ssl: The backend "cert-only" does not support QSslKey qt.network.ssl: Active TLS backend does not support key creation qt.network.ssl: The backend "cert-only" does not support QSslKey qt.network.ssl: Active TLS backend does not support key creation qt.network.ssl: The backend "cert-only" does not support QSslKey qt.network.ssl: Active TLS backend does not support key creation qt.network.ssl: The backend "cert-only" does not support QSslSocket qt.network.ssl: The backend named "cert-only" does not support TLS qt.network.ssl: QSslSocket::connectToHostEncrypted: TLS initialization failed 0 go to the next storage endpoint ``` My SSL backend is: `SSL backend: OpenSSL 3.5.3 16 Sep 2025` I get `OpenSSL 3.0.13 30 Jan 2024` when I run the command `strings /opt/AmneziaVPN/client/lib/libcrypto.so.3 | grep "OpenSSL "` Prior to the latest Amnezia release(5.0.0.5) the program always used to try and make a connection to `gw.amnezia.org` on port 80 which I have permanently blocked on my firewall. And, things used to work probably because it chose to use a different endpoint. This is no longer possible with 5.0.0.5. I don't believe I'm being unreasonable by blocking unencrypted HTTP connections. Also seeing `gw.amnezia.org` in my logs is a dead giveaway that I'm using a VPN and which one in particular. Could the libraries that come with 5.0.5 and earlier versions be too old? In my case on Linux they're located in `/opt/AmneziaVPN/client/lib` I could be wrong, but it appears to me these outdated libraries are the reason the program tries to make a connection on port 80.

bsakaguchi commented

2026-10-13 20:40:10 +00:00

Author

Owner

@gilgamaze commented on GitHub (Jul 30, 2026):

Mea Culpa!
It turns out that opensuse tumblweed is still using libssl.so.3.5.3 even though libssl 4 is out
https://opensuse.pkgs.org/tumbleweed/opensuse-oss-x86_64/libopenssl3-3.5.3-6.1.x86_64.rpm.html

I downloaded, built and installed version 4. I am now able to connect, although Amnezia still starts by attempting to connect to gw.amnezia.org on port 80.

@gilgamaze commented on GitHub (Jul 30, 2026): Mea Culpa! It turns out that opensuse tumblweed is still using libssl.so.3.5.3 even though libssl 4 is out https://opensuse.pkgs.org/tumbleweed/opensuse-oss-x86_64/libopenssl3-3.5.3-6.1.x86_64.rpm.html I downloaded, built and installed version 4. I am now able to connect, although Amnezia still starts by attempting to connect to gw.amnezia.org on port 80.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1320

No description provided.

Rows
Columns