For a while now I have been getting this error in the log;
DoH server connection error: The user callback function failed
I scratched through router OS and the internet for a few weeks now, tried a few things but I cannot find the reason why it does this. I am using the cloudflare doh server 1.1.1.1 which I got from this tutorial :
Your DNS configuration will be helpful for providing advice.
Yeah that makes sense, here you go, not sure if that is all the info that is needed:
/ip/dns> print
servers:
dynamic-servers:
use-doh-server: https://1.1.1.1/dns-query
verify-doh-cert: yes
doh-max-server-connections: 5
doh-max-concurrent-queries: 50
doh-timeout: 5s
allow-remote-requests: yes
max-udp-packet-size: 4096
query-server-timeout: 2s
query-total-timeout: 10s
max-concurrent-queries: 100
max-concurrent-tcp-sessions: 20
cache-size: 80000KiB
cache-max-ttl: 1w
address-list-extra-time: 0s
vrf: main
mdns-repeat-ifaces:
cache-used: 7123KiB
Overall, the DoH configuration is standard.
All that remains is to find out which certificates have been uploaded.
Two certificates are needed, and they can be downloaded directly from the 1.1.1.1 website: the SSL.com ECC Root Certification Authority(file SSL.com Root Certification Authority ECC.crt) and the SSL.com SSL Intermediate CA ECC R2 Intermediate Certification Authority (file:SSL.com SSL Intermediate CA ECC R2.crt).
I have several MT devices running Clouflare DoH at this config without any issues.
I have this one installed, but SSL.com SSL Intermediate CA ECC R2.crt for the life of me I cannot find this one on the internet to download. I am little out of my depth here tbh.
In Chrome:
Open https://1.1.1.1
Right click on icon next to the address bar one.one.one.one
Click on Connection is secure then Certificate is valid then Details.
Select SSL.com SSL Intermediate CA ECC R2 then Export... button
Wonderful thank you. Hopefully that solves the problem.
Unfortunately the problem persists.
Got it...
Is it the same error?
What device and ROS version are you using?
Is the device configured as an NTP client for time synchronization?
It would be good if you provide full config (in preformatted text) without sensitive data (edited without serial number, public ips, passwords & etc).
In terminal: /system export file=anyname
Yep same error.
RB5009 non POE version, latest ROS.
NTP client not configured
Will provide full config in a few hours.
The router's time must be synchronized via an NTP client for Cloudflare DoH (or any other) to function correctly with certificate verification enabled.
Great I will configure that and see how it goes. Thanks alot for the help so far.
For default, RouterOS sync time with his own cloud, if NTP is not set or not work.