Mikrotik DOH problem

Setup:
Mikrotik hAP ac3 - RouterOS V7.20.4
Adguard Home - v.0.107.69

I have a selfhosted Adguard Home acting as a private DNS server. Adguard is hosted on a online-bought VPS.
My mikrotik was cooperating just fine for a couple weeks with this setup:
dns changed by mikrotik-pro-app-1.5.7(android)/tcp-msg(winbox):[redacted]@10.0.10.178 (/ip dns set allow-remote-requests=yes cache-max-ttl=1w cache-size=2048KiB doh-max-concurrent-queries=50 doh-max-server-connections=5 doh-timeout=5s max-concurrent-queries=100 max-concurrent-tcp-sessions=20 max-udp-packet-size=4096 query-server-timeout=2s query-total-timeout=10s servers=xxx.xxx.xxx.xxx use-doh-server=``https://xxx.xxx.xxx.xxx/dns-query/router`` verify-doh-cert=no vrf=main)

A couple days ago I started receiveng this message in the logs:
DoH server connection error: SSL: ssl: no common version (6)
and all the DOH traffic coming through mikrotik stopped.
Let me just point out that Adguard processes DOH traffic coming from other sources with no problems at all.

I'm all lost. I didn't find any docs regarding this error message and I honestly got no idea what it is about.

Already tried: importing certs and verifying DOH cert with no luck.

ROS currently supports SSL versions up to TLS 1.2. Some services started to require use of TLS 1.3 ... which is what most modern softwares (browsers, DoH clients, etc.) support since quite a while ago.

1 Like

Why are you using doh on the mikrotik when you have an adguard home server??

Thank you for your suggestion.

Fiddling around with NGINX TLS config did the trick.