Unit breaks my Drupal site in Safari browsers

[fred666333]

Hello,

As the title says, my site is unstable in Safari. Sometimes it looks like css is not read. If I reload a couple of times, the page looks good. It happens on both mac, iphone and ipad. The strange thing is that Brave Browser and Firefox never have any problems. It is only Safari.

Below follows the code. It is Unit's Drupal template, and I have added redirection to "https" and "www". Perhaps I have not done that properly.

If anyone has imporvement suggestions I would appreciate that!

{ "listeners": { "*:80": { "pass": "routes/main" }, "*:443": { "pass": "routes/route2", "tls": { "certificate": "bundle2" } } },

"routes": {

"main": [ { "match": { "scheme": "http" }, "action": { "return": 301, "location": "https://$host$request_uri" } } ],

`"route2": [
  {
    "match": {
      "host": "example.com"
    },
    "action": {
      "return": 301,
      "location": "https://www.$host$request_uri"
    }
  },
  {
    "match": {
      "uri": [
        "!*/.well-known/*",
        "/vendor/*",
        "/core/profiles/demo_umami/modules/demo_umami_content/default_content/*",
        "*.engine",
        "*.inc",
        "*.install",
        "*.make",
        "*.module",
        "*.po",
        "*.profile",
        "*.sh",
        "*.theme",
        "*.tpl",
        "*.twig",
        "*.xtmpl",
        "*.yml",
        "*/.*",
        "*/Entries*",
        "*/Repository",
        "*/Root",
        "*/Tag",
        "*/Template",
        "*/composer.json",
        "*/composer.lock",
        "*/web.config",
        "*sql",
        "*.bak",
        "*.orig",
        "*.save",
        "*.swo",
        "*.swp",
        "*~"
      ]
    },
    "action": {
      "return": 404
    }
  },
  {
    "match": {
      "uri": [
        "/core/authorize.php",
        "/core/core.api.php",
        "/core/globals.api.php",
        "/core/install.php",
        "/core/modules/statistics/statistics.php",
        "~^/core/modules/system/tests/https?\\.php",
        "/core/rebuild.php",
        "/update.php",
        "/update.php/*"
      ]
    },
    "action": {
      "pass": "applications/drupal/direct"
    }
  },
  {
    "match": {
      "uri": [
        "!/index.php*",
        "*.php"
      ]
    },
    "action": {
      "return": 404
    }
  },
  {
    "action": {
      "share": "/home/me/www/drupal/web$uri",
      "types": [
        "image/*",
        "text/*"
      ],
      "response_headers": {
        "Cache-Control": "max-age=31556952"
      },
      "fallback": {
        "pass": "applications/drupal/index"
      }
    }
  }
]`

},
"applications": { "drupal": { "type": "php", "user": "me", "group": "me", "targets": { "direct": { "root": "/home/me/www/drupal/web/" }, "index": { "root": "/home/me/www/drupal/web/", "script": "index.php" } } } } }

Fred

[ac000]

Using the browsers builtin tools do you see requests for specific files failing and with what status code?

[fred666333]

Brave says "no issues detected" and "0 page errors", "0 breaking changes" and "0 possible improvements". Is there anything special I should look for?

[ac000]

The problem is with Safari no?

[fred666333]

The browser tools have so many features that I get overwhelmed...

With Nginx no problems with any browser. With Unit problems with Safari but not with other browsers.

I suspect it has to do with ssl. I did not have any problems when I tested my site with http. I added a session under tls.:

{
"pass": "routes/route2",
"tls": {
"certificate": "bundle2",
"session": {
"cache_size": 10240,
"timeout": 60
}
}
}
It seems promising. No sitebreaks so far after that.

[fred666333]

Still problems. I found an error in Safari's inspector after it has happened: "Failed to load resource: An SSL error has occurred and a secure conection to the server cannot be established." As i suspected, it has to to with ssl

[fred666333]

And here is the Unit log:
2025/04/05 14:23:35 [info] 55294#55294 "drupal" application started
2025/04/05 14:29:06 [info] 41795#41799 *994 SSL_do_handshake(41) failed (193: no shared cipher) (OpenSSL: error:0A0000C1:SSL routines::no shared cipher)
2025/04/05 14:29:06 [alert] 41795#41798 *996 SSL_do_handshake(43) failed (396: version too low) (OpenSSL: error:0A00018C:SSL routines::version too low)
2025/04/05 14:29:06 [alert] 41795#41798 *997 SSL_do_handshake(38) failed (258: unsupported protocol) (OpenSSL: error:0A000102:SSL routines::unsupported protocol)
2025/04/05 14:29:06 [alert] 41795#41798 *999 SSL_do_handshake(42) failed (258: unsupported protocol) (OpenSSL: error:0A000102:SSL routines::unsupported protocol)

[fred666333]

I added these "conf_commands". I will see if it makes any difference:
"conf_commands": { "ciphersuites": "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256", "minprotocol": "TLSv1.3" }

[fred666333]

No it did not. The log says:

2025/04/05 14:53:55 [info] 56331#56331 "drupal" application started
2025/04/05 14:53:58 [alert] 56190#56193 *46 SSL_do_handshake(44) failed (258: unsupported protocol) (OpenSSL: error:0A000102:SSL routines::unsupported protocol)
2025/04/05 14:53:58 [alert] 56190#56193 *48 SSL_do_handshake(44) failed (258: unsupported protocol) (OpenSSL: error:0A000102:SSL routines::unsupported protocol)
2025/04/05 14:53:58 [alert] 56190#56193 *49 SSL_do_handshake(44) failed (258: unsupported protocol) (OpenSSL: error:0A000102:SSL routines::unsupported protocol)
2025/04/05 14:53:58 [alert] 56190#56193 *50 SSL_do_handshake(44) failed (396: version too low) (OpenSSL: error:0A00018C:SSL routines::version too low)

Does anybode know what unsupported protocol and version to low mean? I am on Ubuntu 24.04. Openssl version is 3.0.13.

[ac000]

As you can see from the files there is a "Partial test failure" in Safari but not in Firefox. I suppose that explains why the handshake errors only happens in Safari. I am on mac and have no firewall.

Yup, definitely something screwy with Safari...

Looks like

"conf_commands": {
    "ciphersuites": "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256",
    "minprotocol": "TLSv1.3" 
}

Should have maybe worked...

[fred666333]

If I refresh Safari in Qualys SSL Labs, it is green! It is the same with my site. If I refresh, the handshake works.

Strange though, that Nginx always work.

[fred666333]

I got the following output in the terminal:
openssl ciphers -s -tls1_3
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

I changed "ciphersuites": "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
to match the terminal output:
"ciphersuites": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

As you see the order is different. After that I have not encountered any sitebreaks. Can the order have relevance?

[ac000]

I believe they are in order of preference.

[fred666333]

Thanks, It seems stable right now. The page loads fast. No site breaks since I changed the order in "ciphersuites".

[fred666333]

Update: The order in "ciphersuites": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" was of no relevance. The site break came back.

Then I tried to switch back to Nginx. To my big surprise, my site broke there as well. I attach a screenshot. As you can see it failed to load a resource. I can translate the rest: "An SSL error has occurred and a secure connection to the server cannot be established" or similar.

In Unit it is a css resource that fails to load. In Nginx it is a js resource that fails to load. A refresh loads the site.

I also have a test server with Unit and PHP 8.3 and a self-signed certificate. I have not been able to reproduce the resource load error there. On my live server I use PHP 8.4. Both use Ubuntu 24.04.

The resource load error only occurs in Safari. Brave and Firefox have no problems. According to this page, https://tls.support, Safari does not have a feature called "TLS Session Resumption", which Brave and Firefox have.

So my theory right now is that Safari has problems with PHP 8.4. Unit is not the cause.

[ac000]

So my theory right now is that Safari has problems with PHP 8.4. Unit is not the cause.

I do actually doubt that. nginx/unit will be the TLS termination point. PHP shouldn't be involved.

[fred666333]

Thanks, You are the expert. I can only state that for six months I had no problems whatsoever with Drupal 11, PHP 8.3 and Nginx. With Drupal 11, Nginx (and Unit) and php 8.4 I have constant problems. I will create a new VM and test with php 8.3.

[ac000]

How are you serving the static files? I would have assumed PHP is not involved in that. E.g. Using Unit's static share functionality...

[fred666333]

In Unit I am just using Unit's template for Drupal https://unit.nginx.org/howto/drupal/
I have not changed anything besides a 443 listener.

[ac000]

Yeah, so your .js/.css etc should just be served directly by Unit with no PHP involved.