Connection fails no matter what URL (Nosebleed Jailbreak)

[chorikii]

To show that annas archive isnt blocked for me, i managed to access it via Browser on Kindle. It seems like no matter what URL i use, it fails on KindleFetch

[viniciuseugenio]

Same problem here

[fedpx]

Same here
I guess the problem is with curl preferred TLS version. When doing curl https://annas-archive.gl from kterm I receive an error: curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version.
After doing the -v curl I got these errors:

TLSv1.2 (IN), TLS header, Unknown (21)
TLSv1.2 (IN), TLS alert, protocol version (582)

I guess the problem is in Cloudflare requred cyphers which are absent in curl 1.0.2q on my version of Kindle.

[pigbait]

Same problem here, any way of fixing this?

Edit: I see a new commit has been worked on. I guess we just need to wait for the new version?

[tetrabit]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it. I thought it was a DNS issue at first but its apparently an issue with the curl version is so old on some kindles that the sites reject the connection

What this usually is (not just URL blocking)

On some Kindles, KindleFetch fails URL checks even when the site opens in browser because KindleFetch uses the system curl/TLS stack, which can be too old for current TLS requirements.

Typical error from CLI tests:

SSL23_GET_SERVER_HELLO: tlsv1 alert protocol version

In other words: browser works, but curl in shell fails handshake.

Reproduced environment

• Kindle Paperwhite 2
• Model: PQ948KJ
• Firmware: 15.8.1

How we validated root cause

1. DNS/routing were generally fine.
2. curl to some domains (e.g. GitHub/Cloudflare) worked.
3. curl to Anna mirrors failed with TLS protocol-version alerts.
4. Device had older stack (curl 7.86.0, OpenSSL 1.0.2q).

Fix that worked

Stage 1 (safe test): modern static curl in /mnt/us/bin

mkdir -p /mnt/us/bin
curl -fL -o /mnt/us/bin/curl-static-armhf \
  https://github.com/moparisthebest/static-curl/releases/download/v8.17.0/curl-armhf
chmod +x /mnt/us/bin/curl-static-armhf

Optional wrapper:

cat > /mnt/us/bin/curl <<'EOF2'
#!/bin/sh
exec /mnt/us/bin/curl-static-armhf "$@"
EOF2
chmod +x /mnt/us/bin/curl

Stage 2 (persistent): replace /usr/bin/curl

mntroot rw
cp /usr/bin/curl /usr/bin/curl.system.bak
cp /mnt/us/bin/curl-static-armhf /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Verify

curl --version
curl -s -o /dev/null -w 'http=%{http_code} err=%{errormsg}\n' -L https://annas-archive.vg

Expected after fix: modern curl version and HTTP 200 from mirror checks.

Rollback

mntroot rw
cp /usr/bin/curl.system.bak /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

[pigbait]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it. I thought it was a DNS issue at first but its apparently an issue with the curl version is so old on some kindles that the sites reject the connection

What this usually is (not just URL blocking)

On some Kindles, KindleFetch fails URL checks even when the site opens in browser because KindleFetch uses the system curl/TLS stack, which can be too old for current TLS requirements.

Typical error from CLI tests:

SSL23_GET_SERVER_HELLO: tlsv1 alert protocol version

In other words: browser works, but curl in shell fails handshake.

Reproduced environment

• Kindle Paperwhite 2
• Model: PQ948KJ
• Firmware: 15.8.1

How we validated root cause

1. DNS/routing were generally fine.
2. curl to some domains (e.g. GitHub/Cloudflare) worked.
3. curl to Anna mirrors failed with TLS protocol-version alerts.
4. Device had older stack (curl 7.86.0, OpenSSL 1.0.2q).

Fix that worked

Stage 1 (safe test): modern static curl in /mnt/us/bin

mkdir -p /mnt/us/bin
curl -fL -o /mnt/us/bin/curl-static-armhf
https://github.com/moparisthebest/static-curl/releases/download/v8.17.0/curl-armhf
chmod +x /mnt/us/bin/curl-static-armhf
Optional wrapper:

cat > /mnt/us/bin/curl <<'EOF2'
#!/bin/sh
exec /mnt/us/bin/curl-static-armhf "$@"
EOF2
chmod +x /mnt/us/bin/curl

Stage 2 (persistent): replace /usr/bin/curl

mntroot rw
cp /usr/bin/curl /usr/bin/curl.system.bak
cp /mnt/us/bin/curl-static-armhf /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Verify

curl --version
curl -s -o /dev/null -w 'http=%{http_code} err=%{errormsg}\n' -L https://annas-archive.vg
Expected after fix: modern curl version and HTTP 200 from mirror checks.

Rollback

mntroot rw
cp /usr/bin/curl.system.bak /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Do we run these commands in kterm? I'm on a Kindle 11th gen

[tetrabit]

You could do it all through kterm I would think. I ssh'd into the kindle and did it from my terminal on my pc through wifi.

Koreader has an ssh server built in that you can turn on.

[lourinaldi]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it.

Can confirm that this fix worked for me. Thanks!

[NightlyDegen]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it. I thought it was a DNS issue at first but its apparently an issue with the curl version is so old on some kindles that the sites reject the connection

What this usually is (not just URL blocking)

On some Kindles, KindleFetch fails URL checks even when the site opens in browser because KindleFetch uses the system curl/TLS stack, which can be too old for current TLS requirements.

Typical error from CLI tests:

SSL23_GET_SERVER_HELLO: tlsv1 alert protocol version

In other words: browser works, but curl in shell fails handshake.

Reproduced environment

• Kindle Paperwhite 2
• Model: PQ948KJ
• Firmware: 15.8.1

How we validated root cause

1. DNS/routing were generally fine.
2. curl to some domains (e.g. GitHub/Cloudflare) worked.
3. curl to Anna mirrors failed with TLS protocol-version alerts.
4. Device had older stack (curl 7.86.0, OpenSSL 1.0.2q).

Fix that worked

Stage 1 (safe test): modern static curl in /mnt/us/bin

mkdir -p /mnt/us/bin
curl -fL -o /mnt/us/bin/curl-static-armhf
https://github.com/moparisthebest/static-curl/releases/download/v8.17.0/curl-armhf
chmod +x /mnt/us/bin/curl-static-armhf
Optional wrapper:

cat > /mnt/us/bin/curl <<'EOF2'
#!/bin/sh
exec /mnt/us/bin/curl-static-armhf "$@"
EOF2
chmod +x /mnt/us/bin/curl

Stage 2 (persistent): replace /usr/bin/curl

mntroot rw
cp /usr/bin/curl /usr/bin/curl.system.bak
cp /mnt/us/bin/curl-static-armhf /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Verify

curl --version
curl -s -o /dev/null -w 'http=%{http_code} err=%{errormsg}\n' -L https://annas-archive.vg
Expected after fix: modern curl version and HTTP 200 from mirror checks.

Rollback

mntroot rw
cp /usr/bin/curl.system.bak /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

This fix also worked for me, thanks

[Pap-Redpaw]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it. I thought it was a DNS issue at first but its apparently an issue with the curl version is so old on some kindles that the sites reject the connection

What this usually is (not just URL blocking)

On some Kindles, KindleFetch fails URL checks even when the site opens in browser because KindleFetch uses the system curl/TLS stack, which can be too old for current TLS requirements.

Typical error from CLI tests:

SSL23_GET_SERVER_HELLO: tlsv1 alert protocol version

In other words: browser works, but curl in shell fails handshake.

Reproduced environment

• Kindle Paperwhite 2
• Model: PQ948KJ
• Firmware: 15.8.1

How we validated root cause

1. DNS/routing were generally fine.
2. curl to some domains (e.g. GitHub/Cloudflare) worked.
3. curl to Anna mirrors failed with TLS protocol-version alerts.
4. Device had older stack (curl 7.86.0, OpenSSL 1.0.2q).

Fix that worked

Stage 1 (safe test): modern static curl in /mnt/us/bin

mkdir -p /mnt/us/bin
curl -fL -o /mnt/us/bin/curl-static-armhf
https://github.com/moparisthebest/static-curl/releases/download/v8.17.0/curl-armhf
chmod +x /mnt/us/bin/curl-static-armhf
Optional wrapper:

cat > /mnt/us/bin/curl <<'EOF2'
#!/bin/sh
exec /mnt/us/bin/curl-static-armhf "$@"
EOF2
chmod +x /mnt/us/bin/curl

Stage 2 (persistent): replace /usr/bin/curl

mntroot rw
cp /usr/bin/curl /usr/bin/curl.system.bak
cp /mnt/us/bin/curl-static-armhf /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Verify

curl --version
curl -s -o /dev/null -w 'http=%{http_code} err=%{errormsg}\n' -L https://annas-archive.vg
Expected after fix: modern curl version and HTTP 200 from mirror checks.

Rollback

mntroot rw
cp /usr/bin/curl.system.bak /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Can confirm this works using kterm. Did not use the optional wrapper, and it still works flawlessly. if you are having trouble using kfetch THIS IS THE ANSWER!

[luisalrp]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it. I thought it was a DNS issue at first but its apparently an issue with the curl version is so old on some kindles that the sites reject the connection

What this usually is (not just URL blocking)

On some Kindles, KindleFetch fails URL checks even when the site opens in browser because KindleFetch uses the system curl/TLS stack, which can be too old for current TLS requirements.

Typical error from CLI tests:

SSL23_GET_SERVER_HELLO: tlsv1 alert protocol version

In other words: browser works, but curl in shell fails handshake.

Reproduced environment

• Kindle Paperwhite 2
• Model: PQ948KJ
• Firmware: 15.8.1

How we validated root cause

1. DNS/routing were generally fine.
2. curl to some domains (e.g. GitHub/Cloudflare) worked.
3. curl to Anna mirrors failed with TLS protocol-version alerts.
4. Device had older stack (curl 7.86.0, OpenSSL 1.0.2q).

Fix that worked

Stage 1 (safe test): modern static curl in /mnt/us/bin

mkdir -p /mnt/us/bin
curl -fL -o /mnt/us/bin/curl-static-armhf
https://github.com/moparisthebest/static-curl/releases/download/v8.17.0/curl-armhf
chmod +x /mnt/us/bin/curl-static-armhf
Optional wrapper:

cat > /mnt/us/bin/curl <<'EOF2'
#!/bin/sh
exec /mnt/us/bin/curl-static-armhf "$@"
EOF2
chmod +x /mnt/us/bin/curl

Stage 2 (persistent): replace /usr/bin/curl

mntroot rw
cp /usr/bin/curl /usr/bin/curl.system.bak
cp /mnt/us/bin/curl-static-armhf /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Verify

curl --version
curl -s -o /dev/null -w 'http=%{http_code} err=%{errormsg}\n' -L https://annas-archive.vg
Expected after fix: modern curl version and HTTP 200 from mirror checks.

Rollback

mntroot rw
cp /usr/bin/curl.system.bak /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

It solved me the search issue but I couldn't download anything from zlib. Any ideas?

[Maduki-tech]

also needed to update the URL of annas-archive to a new Domain
see here
https://www.reddit.com/r/Annas_Archive/comments/1rj50kg/goodbye_li_welcome_new_domains/#:~:text=%2Evg,updated

[makfries]

I was seeing the same issue and fixed it by updating curl manually, heres a writeup from codex on how it fixed it. I thought it was a DNS issue at first but its apparently an issue with the curl version is so old on some kindles that the sites reject the connection

What this usually is (not just URL blocking)

On some Kindles, KindleFetch fails URL checks even when the site opens in browser because KindleFetch uses the system curl/TLS stack, which can be too old for current TLS requirements.

Typical error from CLI tests:

SSL23_GET_SERVER_HELLO: tlsv1 alert protocol version

In other words: browser works, but curl in shell fails handshake.

Reproduced environment

• Kindle Paperwhite 2
• Model: PQ948KJ
• Firmware: 15.8.1

How we validated root cause

1. DNS/routing were generally fine.
2. curl to some domains (e.g. GitHub/Cloudflare) worked.
3. curl to Anna mirrors failed with TLS protocol-version alerts.
4. Device had older stack (curl 7.86.0, OpenSSL 1.0.2q).

Fix that worked

Stage 1 (safe test): modern static curl in /mnt/us/bin

mkdir -p /mnt/us/bin
curl -fL -o /mnt/us/bin/curl-static-armhf
https://github.com/moparisthebest/static-curl/releases/download/v8.17.0/curl-armhf
chmod +x /mnt/us/bin/curl-static-armhf
Optional wrapper:

cat > /mnt/us/bin/curl <<'EOF2'
#!/bin/sh
exec /mnt/us/bin/curl-static-armhf "$@"
EOF2
chmod +x /mnt/us/bin/curl

Stage 2 (persistent): replace /usr/bin/curl

mntroot rw
cp /usr/bin/curl /usr/bin/curl.system.bak
cp /mnt/us/bin/curl-static-armhf /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

Verify

curl --version
curl -s -o /dev/null -w 'http=%{http_code} err=%{errormsg}\n' -L https://annas-archive.vg
Expected after fix: modern curl version and HTTP 200 from mirror checks.

Rollback

mntroot rw
cp /usr/bin/curl.system.bak /usr/bin/curl
chmod 755 /usr/bin/curl
mntroot ro

This solution worked for me, thank you!