Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,14 +1,12 @@
---
title: "Connectivity Issues"
description: "Diagnosing and resolving synchronizer connection failures, TLS errors, and VPN problems"
description: "Diagnosing and resolving synchronizer connection failures and TLS errors"
---


import CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL36 from "/snippets/canton-docs/global-synchronizer_troubleshooting-guide_connectivity-issues_L36.mdx";
import CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL71 from "/snippets/canton-docs/global-synchronizer_troubleshooting-guide_connectivity-issues_L71.mdx";
import CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL101 from "/snippets/canton-docs/global-synchronizer_troubleshooting-guide_connectivity-issues_L101.mdx";
import CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL121 from "/snippets/canton-docs/global-synchronizer_troubleshooting-guide_connectivity-issues_L121.mdx";
import CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL128 from "/snippets/canton-docs/global-synchronizer_troubleshooting-guide_connectivity-issues_L128.mdx";

Connectivity failures prevent your validator from communicating with the synchronizer. The symptoms vary -- from outright connection refusals to subtle TLS handshake errors -- but the diagnostic approach is consistent.

Expand Down Expand Up @@ -96,33 +94,3 @@ If you see `PKIX path building failed`, the validator's JVM does not trust the s
If the certificate's Subject Alternative Name (SAN) does not include the hostname you are connecting to, the handshake will fail. Verify with:

<CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL101 />


## VPN Problems

DevNet requires a VPN connection. TestNet and MainNet validators connect over the public internet but may still use VPNs for internal infrastructure.

### VPN Connection Drops

If your validator periodically loses connectivity, check:

- VPN client logs for reconnection events
- Whether the VPN assigns a stable IP (some providers rotate IPs on reconnect, which can break IP-whitelisted access)

### MTU Issues

VPN tunnels reduce the effective MTU. If you see stalled connections that work for small requests but hang on larger payloads:

<CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL121 />


If pings succeed at 1400 bytes but fail at 1500, lower the MTU on the VPN interface:

<CantonGlobalSynchronizerTroubleshootingGuideConnectivityIssuesL128 />


### Split-Tunnel Configuration

If your VPN routes all traffic through the tunnel, the validator may be unable to reach external services (OIDC provider, container registries). Configure split-tunnel routing so that only synchronizer traffic goes through the VPN, while other traffic uses the default gateway.

Consult your VPN provider's documentation for split-tunnel setup.

This file was deleted.

This file was deleted.