download attempts fail with openssl errors

Question

Attempting downloads result in failures with openssl errors.

E.g.: trying to download https://bitbucket.org/mpyne/game-music-emu/downloads/game-music-emu-0.6.3.tar.gz or https://bitbucket.org/neozeed/q2dos/downloads/q2dos_20210722_win64.7z gives the following error in firefox 99.0.1 or 100.0 on windows:

```

Secure Connection Failed

An error occurred during a connection to bbuseruploads.s3.amazonaws.com. SSL received a record that exceeded the maximum permissible length.

Error code: SSL_ERROR_RX_RECORD_TOO_LONG

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

```

Or, on linux, using curl or wget:

```

$ curl -L -o game-music-emu-0.6.3.tar.gz https://bitbucket.org/mpyne/game-music-emu/downloads/game-music-emu-0.6.3.tar.gz
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (35) SSL connect error

$ wget -O game-music-emu-0.6.3.tar.gz https://bitbucket.org/mpyne/game-music-emu/downloads/game-music-emu-0.6.3.tar.gz
--2022-05-03 18:31:20-- https://bitbucket.org/mpyne/game-music-emu/downloads/game-music-emu-0.6.3.tar.gz
Resolving bitbucket.org... 104.192.141.1, 2406:da00:ff00::22e9:9f55, 2406:da00:ff00::22c5:2ef4, ...
Connecting to bitbucket.org|104.192.141.1|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://bbuseruploads.s3.amazonaws.com/3127d31b-b75b-4a58-9d98-e840d5eee00a/downloads/b54f3f22-eefd-4357-838f-f2d60563349d/game-music-emu-0.6.3.tar.gz?Signature=eYFjnLaKsWBZdMZ7hhRRguCW%2F8I%3D&Expires=1651593653&AWSAccessKeyId=AKIA6KOSE3BNA7WTAGHW&versionId=sfGosBl1C1ujJ.KuQbVGTHJvFjNs2NPZ&response-content-disposition=attachment%3B%20filename%3D%22game-music-emu-0.6.3.tar.gz%22&response-content-encoding=None [following]
--2022-05-03 18:31:21-- https://bbuseruploads.s3.amazonaws.com/3127d31b-b75b-4a58-9d98-e840d5eee00a/downloads/b54f3f22-eefd-4357-838f-f2d60563349d/game-music-emu-0.6.3.tar.gz?Signature=eYFjnLaKsWBZdMZ7hhRRguCW%2F8I%3D&Expires=1651593653&AWSAccessKeyId=AKIA6KOSE3BNA7WTAGHW&versionId=sfGosBl1C1ujJ.KuQbVGTHJvFjNs2NPZ&response-content-disposition=attachment%3B%20filename%3D%22game-music-emu-0.6.3.tar.gz%22&response-content-encoding=None
Resolving bbuseruploads.s3.amazonaws.com... 52.217.70.60
Connecting to bbuseruploads.s3.amazonaws.com|52.217.70.60|:443... connected.
OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Unable to establish SSL connection.

```

maraakate · Answer

Hi, I've been following this issue as sezero is a user who pointed out this problem to me. We've had this same complaint a few times over the past year or two from other users.

I'm venturing a guess, but it seems that bitbucket uses AWS for the file downloads. I'm wondering if these certs for certain regions are expired/invalid and have not been fixed and this is why the error persists.

Another possibility is ISP or Proxy filtering. I think testing via tethering a phone or using a US proxy may help shed some light. Every single time I've had a complaint about this from our repos it's been from users who are not in the US and I wonder if certain regions are not updated/maintained as frequently as they should be.

sezero · Answer

Did as you asked, verified that I haven't ever locally stored any certs, but downloads still fail for me with the error I reported. (Viewing bitbucket.org cert, it really is from Apr. 27 2022.)

Viewing, logging in and out of bitbutcket site are OK. Working with git repos is OK. Only the downloads are problem for me. (E.g. files from https://bitbucket.org/neozeed/q2dos/downloads/ or https://bitbucket.org/mpyne/game-music-emu/downloads/ )

Andy Heinzer · Answer

It's working for me when I try your curl command.  I suggest that you try to clear the locally stored SSL certificate you might have on your system for the bitbucket.org domain.  We have recently posted a new certificate within the last 24-36 hours.

In Firefox, load the Bitbucket.org site, and then in Windows press Ctrl + I this will bring up the page info.  Under the security tab there, you should be able to view the certificate your browser is using to try to connect to that site.  There is also a button here to clear cookies and site data.  Try that, as this can then force your system to grab an updated SSL cert for this site.