Repository: miniflux/v2 (language: go)

Issue:
Miniflux is not able to reach this website due to a network error: Get "https://cdm.link/feed/": remote error: tls: handshake failure.
Trying to add https://cdm.link/feed/ to miniflux and I get this "tls: handshake" failure.

curl can fetch the feed fine:
```
$ curl -v https://cdm.link/feed/
*   Trying 81.169.248.37:443...
* TCP_NODELAY set
* Connected to cdm.link (81.169.248.37) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* NPN, negotiated HTTP1.1
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Next protocol (67):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / AES256-SHA
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=cdm.link
*  start date: Apr  7 14:40:41 2024 GMT
*  expire date: Jul  6 14:40:40 2024 GMT
*  subjectAltName: host "cdm.link" matched cert's "cdm.link"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
> GET /feed/ HTTP/1.1
> Host: cdm.link
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.8.0
< Date: Wed, 29 May 2024 17:57:44 GMT
< Content-Type: application/rss+xml; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Last-Modified: Tue, 28 May 2024 22:06:03 GMT
< ETag: "4bf3621e368a5cb7f16bb1842b69e2f1"
< Link: <https://cdm.link/wp-json/>; rel="https://api.w.org/"
< X-UA-Compatible: IE=Edge
<
<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"

```


Discussion / hints:

Fix patch:
diff --git a/internal/reader/fetcher/request_builder.go b/internal/reader/fetcher/request_builder.go
index 77c18948fff..5ed10a51ef8 100644
--- a/internal/reader/fetcher/request_builder.go
+++ b/internal/reader/fetcher/request_builder.go
@@ -109,6 +109,16 @@ func (r *RequestBuilder) IgnoreTLSErrors(value bool) *RequestBuilder {
 }
 
 func (r *RequestBuilder) ExecuteRequest(requestURL string) (*http.Response, error) {
+	// We get the safe ciphers
+	ciphers := tls.CipherSuites()
+	if r.ignoreTLSErrors {
+		// and the insecure ones if we are ignoring TLS errors. This allows to connect to badly configured servers anyway
+		ciphers = append(ciphers, tls.InsecureCipherSuites()...)
+	}
+	cipherSuites := []uint16{}
+	for _, cipher := range ciphers {
+		cipherSuites = append(cipherSuites, cipher.ID)
+	}
 	transport := &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		// Setting `DialContext` disables HTTP/2, this option forces the transport to try HTTP/2 regardless.
@@ -128,6 +138,7 @@ func (r *RequestBuilder) ExecuteRequest(requestURL string) (*http.Response, erro
 		IdleConnTimeout: 10 * time.Second,
 
 		TLSClientConfig: &tls.Config{
+			CipherSuites:       cipherSuites,
 			InsecureSkipVerify: r.ignoreTLSErrors,
 		},
 	}


Test patch: