Desktop Keybase fails to send messages due to TLS hostname mismatch on api-1.core.keybaseapi.com #28842
Description
The Keybase desktop client is currently unable to send chat messages due to a TLS certificate hostname mismatch when connecting to the core API endpoint.
The client reports:
Failed to send chat message: Post "https://api-1.core.keybaseapi.com/_/api/1.0/chat/send.json":
x509: certificate is valid for *.us-east-1.es.amazonaws.com, not api-1.core.keybaseapi.com
This appears to be a server-side TLS configuration issue: the API endpoint is presenting a valid Amazon-issued certificate, but the certificate does not include the Keybase hostname in its SAN.
Steps to Reproduce:
- Run Keybase desktop client (Windows, but likely platform-independent)
- Attempt to send a chat message
- Message fails immediately with TLS error above
Observed TLS diagnostics
api-1.core.keybaseapi.com -> AWS us-east-1 IPs
OpenSSL test:
openssl s_client -connect api-1.core.keybaseapi.com:443 -servername api-1.core.keybaseapi.com
Relevant output:
subject=CN = *.us-east-1.es.amazonaws.com
issuer=C = US, O = Amazon, CN = Amazon RSA 2048 M01
Verify return code: 0 (ok)
The certificate chain is valid and trusted, but does not match the requested hostname.