Buran failing to connect to capsule. TLS issue?

[acidus99]

I noticed that Buran v1.12 is failing to connect to a capsule when other Gemini clients do. Specifically this when accessing the capsule gemini://lark.gay/ I am seeing a dialog that reads:

Error
Bad response: Server Error:
Connection closed by peer

I'm running Buran v1.12 on a Amazon Fire tablet, with the latest updates to the OS.

I suspect this might be a TLS issue, and the ciphers Buran is offering in the TLS handshake don't align with what the server wants. Or it could be something else entirely. Below is the outout of sslscan, which shows what ciphers and key exchanges a TLS-protected service supports. This may aid your debugging:

$ sslscan lark.gay:1965
Version: 2.1.2
OpenSSL 3.2.0 23 Nov 2023

Connected to 137.184.49.7

Testing SSL server lark.gay on port 1965 using SNI name lark.gay

  SSL/TLS Protocols:
SSLv2     disabled
SSLv3     disabled
TLSv1.0   disabled
TLSv1.1   disabled
TLSv1.2   enabled
TLSv1.3   enabled

  TLS Fallback SCSV:
Server does not support TLS Fallback SCSV

  TLS renegotiation:
Session renegotiation not supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

  Heartbleed:
TLSv1.3 not vulnerable to heartbleed
TLSv1.2 not vulnerable to heartbleed

  Supported Server Cipher(s):
Preferred TLSv1.3  128 bits  TLS_AES_128_GCM_SHA256        Curve 25519 DHE 253
Accepted  TLSv1.3  256 bits  TLS_AES_256_GCM_SHA384        Curve 25519 DHE 253
Accepted  TLSv1.3  256 bits  TLS_CHACHA20_POLY1305_SHA256  Curve 25519 DHE 253
Preferred TLSv1.2  256 bits  ECDHE-ECDSA-AES256-GCM-SHA384 Curve 25519 DHE 253
Accepted  TLSv1.2  256 bits  ECDHE-ECDSA-CHACHA20-POLY1305 Curve 25519 DHE 253
Accepted  TLSv1.2  128 bits  ECDHE-ECDSA-AES128-GCM-SHA256 Curve 25519 DHE 253

  Server Key Exchange Group(s):
TLSv1.3  128 bits  secp256r1 (NIST P-256)
TLSv1.3  192 bits  secp384r1 (NIST P-384)
TLSv1.3  128 bits  x25519
TLSv1.2  128 bits  secp256r1 (NIST P-256)
TLSv1.2  192 bits  secp384r1 (NIST P-384)
TLSv1.2  128 bits  x25519

  SSL Certificate:
Signature Algorithm: ED25519
    Public Key: Unknown
Subject:  lark.gay
Altnames: DNS:lark.gay
Issuer:   lark.gay

Not valid before: Jan  1 00:00:00 1975 GMT
Not valid after:  Jan  1 00:00:00 4096 GMT