@neverpanic@chaos.social Yes, Debian is using:
ii openssl 3.5.4-1~deb13u2
But I’ve looked very closely at the two sets of negotiations, and there were only very minor differences. I had tried configuring off the hybrid post-quantum ciphers/etc, but it made no difference.
It’s just something about openssl 3.5 negotiation causes Azure to generate larger packets, and only IPv6 had this cause an issue. As else-thread, likely because something in Azure is eating the icmpv6 “message too long” packets before they make it to whatever the TLS is terminating on.
The working negotiation, from my Debian 12/bookworm host, has it re-assembling 3 TCP fragments of size: 1219, 1420 and 1062. With the broken 13/trixie setup my end only ever sees a 2nd fragment of length 1326, the first fragment is never seen.
So, whilst a different openssl version might not help the packet size, this really is about the path back to Azure not getting the “message too long” message and thus it never retries with viable fragment sizes.