Certificate problem? `fly deploy` failing with phoenixframework/tailwind

Since yesterday, my Phoenix deployments have started failing with this error.

I tried upgrading to the latest tailwind but it didn’t make any difference.

1.159 07:24:05.049 [debug] Downloading tailwind from https://github.com/tailwindlabs/tailwindcss/releases/download/v3.2.7/tailwindcss-linux-x64
1.741 
1.741 07:24:05.601 [notice] TLS :client: In state :wait_cert_cr at ssl_handshake.erl:2123 generated CLIENT ALERT: Fatal - Unsupported Certificate
1.741  - {:key_usage_mismatch,
1.741  {{:Extension, {2, 5, 29, 15}, true, [:keyCertSign, :cRLSign]},
1.741   {:Extension, {2, 5, 29, 37}, false, [{1, 3, 6, 1, 5, 5, 7, 3, 1}]}}}
1.766 ** (RuntimeError) Couldn't fetch https://github.com/tailwindlabs/tailwindcss/releases/download/v3.2.7/tailwindcss-linux-x64: {:error, {:failed_connect, [{:to_address, {~c"release-assets.githubusercontent.com", 443}}, {:inet, [:inet], {:tls_alert, {:unsupported_certificate, ~c"TLS client: In state wait_cert_cr at ssl_handshake.erl:2123 generated CLIENT ALERT: Fatal - Unsupported Certificate\n {key_usage_mismatch,{{'Extension',{2,5,29,15},true,[keyCertSign,cRLSign]},\n                      {'Extension',{2,5,29,37},false,[{1,3,6,1,5,5,7,3,1}]}}}"}}}]}}

in my mix.exs (having reverted the tailwind version). I’m not on the latest things so I don’t know if this is something that has been resolved.

defp deps do
    [
      {:bcrypt_elixir, "~> 3.0"},
      {:phoenix, "~> 1.8"},
      {:phoenix_ecto, "~> 4.4"},
      {:ecto_sql, "~> 3.6"},
      {:postgrex, ">= 0.0.0"},
      {:phoenix_html, "~> 3.3"},
      {:phoenix_live_reload, "~> 1.2", only: :dev},
      {:phoenix_live_view, "~> 1.0"},
      {:lazy_html, ">= 0.1.0", only: :test},
      {:elixir_make, ">= 0.9.0"},
      {:floki, ">= 0.30.0"},
      {:phoenix_live_dashboard, "~> 0.8.3"},
      {:esbuild, "~> 0.7", runtime: Mix.env() == :dev},
      {:tailwind, "~> 0.2.0", runtime: Mix.env() == :dev},
      {:swoosh, "~> 1.19"},
      {:mimerl, "~> 1.4"},
      {:multipart, "~> 0.4.0"},
      {:finch, "~> 0.18"},
      {:telemetry_metrics, "~> 0.6"},
      {:telemetry_poller, "~> 1.0"},
      {:gettext, "~> 0.20"},
      {:jason, "~> 1.2"},
      {:joken, "~> 2.5"},
      {:httpoison, "~> 2.0"}, # used to validate apple token
      {:stripity_stripe, "~> 2.0"},
      {:number, "~> 1.0.1"},
      {:premailex, "~> 0.3.0"},

      {:inflex, "~> 2.0.0"},
      {:timex, "~> 3.0"},
      {:mdex, "~> 0.2"},

      {:nimble_csv, "~> 1.1"},

      {:ex_aws, "~> 2.2"},
      {:ex_aws_s3, "~> 2.1"},
      {:honeybadger, "~> 0.16"},
      {:ecto_psql_extras, "~> 0.6"},

      {:ex_money, "~> 5.0"},
      {:contex, "~> 0.5"},
      {:vega_lite, "~> 0.1.11"},
      {:chartkick, "~> 1.0.0"},
      {:vix, "~> 0.23"},

      {:ex_cldr_locale_display, "~> 1.1"},

      {:app_store, git: "https://github.com/goodtohear/app_store.git"},
      {:goth, "~> 1.4"}, # google auth
      # {:openai_ex, "~> 0.6"},

      {:openai, "~> 0.6.1"},

      {:geoip, "~> 0.2.8"},

      {:qr_code, "~> 3.2.0"},

      {:plug_cowboy, "~> 2.7"}
    ]
  end

Hi - this is a problem with the Elixir runtime being unable to download tailwind due to an unsupported certificate. It’s not something with the Fly platform or environment. It could be something with your base image not including a required root cert or something, but that’d be rare, and it smells more like Elixir itself (actually the underlying erlang implementation in ssl_handshake.erl) . I found some references here: https://github.com/erlang/otp/issues/9208 and you may have some success fiddling with the version of erlang/otp you’re using.