End-to-end encryption verification fails when connecting through RustDesk OSS server

[layer6org]

Environment

• RustDesk client version: 1.4.9 tested
• RustDesk server: OSS
• hbbs version: 1.1.15
• hbbr version: 1.1.15
• Server OS: Debian Linux
• Self-hosted ID and relay server
• Both clients are configured to use the same self-hosted server and the same current server public key.

Problem

When one RustDesk client attempts to connect to another client through the self-hosted OSS server, the following warning appears:

End-to-end encryption could not be verified.
The remote device may still be setting up. Please try again later.
If this continues, the server may not be trustworthy.
Continue anyway?

The original German message displayed by the client is:

Ende-zu-Ende-Verschlüsselung konnte nicht verifiziert werden.
Das entfernte Gerät wird möglicherweise noch eingerichtet. Versuchen Sie es später erneut.
Wenn dies weiterhin auftritt, ist der Server möglicherweise nicht vertrauenswürdig.
Trotzdem fortfahren?

Server-side observations

The hbbs log reports authentication failures such as:

Authentication failed from : for peer - invalid key

The server key was subsequently rotated, and both hbbs and hbbr report the same new public key.

Both clients were configured with the new public key.

Despite this, the end-to-end encryption verification warning may still appear when attempting to connect from one client to another.

Expected behavior

When:

• both clients use the same self-hosted ID server,
• both clients use the same relay server,
• both clients are configured with the correct current server public key,
• and hbbs and hbbr use the same key pair,

the clients should successfully verify the end-to-end encrypted connection without displaying a server trust warning.

Actual behavior

The client displays an end-to-end encryption verification warning and states that the server may not be trustworthy.

This occurs during an attempted connection between two RustDesk clients using the same self-hosted OSS infrastructure.

Important question

Is this behavior caused by:

• stale client-side key information after server key rotation,
• stale peer public-key information stored in db_v2.sqlite3,
• an incompatibility between RustDesk client 1.4.9 and OSS server 1.1.15,
• or a defect in peer key verification?

It would be helpful to know exactly how clients are expected to handle a server key rotation and whether existing peer public keys stored in the OSS server database must be cleared or re-registered after such a rotation.

[Pity-the-Foo]

I see that despite the fact rustdesk oss server update script claiming "same version" no need to update, there is in fact an updated version of the server on the releases page, we're using 1.1.15 and there's a version 1.1.8 available, is this what's causing the connection to break because the server is dilapidated for client software 1.4.9?

I am able to connect to my client machine if I press continue but my login screen does not show login window, seems like CTRL + ALT + DEL is no longer an option in the action dropdown list, etc...

(Edit: the login screen and missing options was due to not having both clients updated to 1.4.9, "insecure connection" issue still persists, pretty sure this should read "Unsecure connection", unless of course RustDesk has emotional issues... 🤣)

[internethering]

We 've this problem too. With update of client to 1.4.9 the message "End-to-end encryption could not be verified." appeares.

[PcComputerGuy]

Same here. 1.4.8, no problem, 1.4.9 - problem started.

[BHoerner87]

Same. Been dealing with it for a couple weeks. One specific client running Linux Mint shows black on top of all clients having this insecure connection warning. This spans Linux Mint, Pop_OS!, macOS, and includes connections made from iOS. I know I'm conflating a little with the black screen thing, but just to say, neither that nor the insecure connection error existed in my ecosystem before 1.4.9.

[layer6org]

Same Issue exist on Version 1.1.16