Connection timed out when trying to update client

[mahaddon]

Hi
I'm having issues running the client update process from within Filezilla client e.g. Help/About/Check for updates in Chrome and/or MS Edge (Chromium)

The log shows a connection timeout

2020-08-26 15:08:00 27984 2 Status: Requesting https://update.filezilla-project.org/up ... ion=3.49.1
2020-08-26 15:08:00 27984 2 Status: Resolving address of update.filezilla-project.org
2020-08-26 15:08:00 27984 2 Status: Connecting to 49.12.121.47:443...
2020-08-26 15:08:20 27984 2 Error: Connection timed out after 20 seconds of inactivity
2020-08-26 15:08:20 27984 2 Error: File transfer failed

If I paste the URL into a web browser I get a cert error complaining about

e.g. in Chrome
Your connection is not private
Attackers might be trying to steal your information from update.filezilla-project.org (for example, passwords, messages or credit cards). Learn more
NET::ERR_CERT_COMMON_NAME_INVALID

and in Edge Chromium
Your connection isn't private
Attackers might be trying to steal your information from update.filezilla-project.org (for example, passwords, messages or credit cards).
NET::ERR_CERT_COMMON_NAME_INVALID
update.filezilla-project.org uses encryption to protect your information. When Microsoft Edge tried to connect to update.filezilla-project.org this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be update.filezilla-project.org, or a WiFi sign-in screen has interrupted the connection. Your information is still secure because Microsoft Edge stopped the connection before any data was exchanged.

You can't visit update.filezilla-project.org at the moment because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

Testing the domain using Qualys SSL Labs checker https://dev.ssllabs.com/ssltest/analyze ... ismatch=on shows an error with the site cert and I think this is what's causing the errors

e.g. Alternative names filezilla-project.org www.filezilla-project.org MISMATCH

We do use a proxy server with web filtering but I have added both filezilla-project.org and update.filezilla-project.org to both HTTPS Inspection and Proxy Authentication bypass rules so I don't think this is the issue. I think that Chrome and Chromium's security settings are flagging up cert errors because you've configured HSTS

[boco]

If the firewall supports roles, please check if FileZilla is added as a mere FTP client. That would prevent it from accessing any HTTPS resources.
Also check if there is an AV that does intermediate HTTPS scanning (aka man-in-the-middle attack).

As for the browser access, that domain is not supposed to be accessed by a browser, only by FileZilla products. The information provided by the update server will not make any sense to a browser.