Bettercap: http2: server: error reading preface from client ip:port: remote error: tls: bad certificate

[JoachimMenzel]

Hello,
I just installed Kali ARM RPI3 Nexmon, followed installation instructions, trying to open kali.fritz.box, Enter Credentials, but get error: Can't connect to https://kali.fritz.box:8083/api

How to solve it?

Description of the bug or feature request

• Bettercap version you are using ( bettercap -version ).
  bettercap v2.24 (built for linux arm64 with go1.11.6)

• OS version and architecture you are using.
  Linux kali 4.19.29-Re4son-v8+ #6 SMP PREEMPT Wed Mar 27 00:15:50 UTC 2019 aarch64 GNU/Linux

• Go version if building from sources.
  go version go1.11.6 linux/arm64

• Command line arguments you are using.
  root@kali:~/go/bin#
  ./bettercap -caplet https-ui

• Caplet code you are using or the interactive session commands.
  https.ui

• Full debug output while reproducing the issue ( bettercap -debug ... ).
  What should I do?

Steps to Reproduce

1. First Step
   shutdown -r now

2. Second Step
   cd /root/bin/go
   ./bettercap -caplets https-ui
   open Browser and enter https://kali.fritz.box enter creds defined in /usr/local/share/bettercap/caplets/https-ui.cap like:
   set api.rest.username Username
   set api.rest.password Password

3. and so on...
   Get error
   2019/06/10 17:37:31 http2: server: error reading preface from client 192.168.3.2:52549: remote error: tls: bad certificate and/or
   2019/06/10 17:29:14 http: TLS handshake error from 192.168.3.2:52192: EOF

Expected behavior: What you expected to happen
Login to Web UI
Actual behavior: What actually happened
Nothing good happens. Pls help. I followed this instructions:
https://www.bettercap.org/usage/#web-ui
♥

[ione25]

had the same issue here. came here to find solution

[buffermet]

Can you both please include full debug logs as well as the full contents of your caplet files?

[clive7391]

Has this been resolved? I also have the issue.

[devec0]

This issue seems to be isolated to Firefox. As a workaround, I was able to use Chromium.
I'm running latest master compiled with go 1.10.4 on arm64, API version 2.24.1 and UI version 1.3.0.

The message is coming from the transparent HTTP/2 support in Go's http server library. Disabling it using the GODEBUG flags GODEBUG=http2server=0,http2client=0 does not work around this behaviour, I was still not able to connect to the API port.

With http2debug=1 set in GODEBUG I see the following extra debug logging -

2019/09/01 22:37:48 http2: server connection from 172.16.10.50:47450 on 0x44200ad450          
2019/09/01 22:37:48 http2: server: error reading preface from client 172.16.10.50:47450: remot
e error: tls: bad certificate                                                                 
2019/09/01 22:38:27 http: TLS handshake error from 172.16.10.50:38532: remote error: tls: unkn
own certificate                                                                               
2019/09/01 22:38:28 http: TLS handshake error from 172.16.10.50:38534: remote error: tls: unkn
own certificate                                                                               
2019/09/01 22:38:31 http: TLS handshake error from 172.16.10.50:38546: remote error: tls: unkn
own certificate                                                                               
2019/09/01 22:38:32 http2: server connection from 172.16.10.50:38552 on 0x44201541a0

I suspect given the issue is the http2 preface, the server does not trust the client-supplied TLS certificate being sent to establish another HTTP/2 channel.

[mdh99]

Faced the same on Firefox. To allow connetion go to settings of firefox, manage certificates and add a separate server certificate for bettercap , by default only the 443 port will be present , adding the api one will resolve the issue on Firefox.