OPENSSL Bad Decrypt trying to get resources from public AWS S3 bucket

[ConfusedCitizen]

The Problem

Cypress inside docker is throwing an Open SSL Bad decrypt error when trying to access files that are publicly available on an AWS S3 bucket.

I've created a repo with the minimum required reproduction here: Reproduction Repo

Debug Logs

Relevant Notes

• The docker container has no issue accessing any of these resources via Curl and I have tried clearing the cache in Cypress and the Cypress browser and found it makes no difference.
• The docker container has no issues accessing other resources outside of AWS S3
• It also doesn't have this issue if the S3 bucket is served via CloudFront.
• I am running this on an M1 Mac through Docker emulating linux/amd64 using Rosetta.

Let me know if you require additional details.

[MikeMcC399]

@ConfusedCitizen

I wasn't able to reproduce your issue under Ubuntu 24.04.3 LTS, running on an amd64 processor and using Docker Desktop 4.53.0.

I don't have a M1 Mac, so somebody else would need to help you with this.

$ npm run build-and-test

> test@0.0.0 build-and-test
> docker build --platform linux/amd64 -t cypress-ssl-fail . && npm run test

[+] Building 198.8s (11/11) FINISHED                                                                           docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                           0.1s
 => => transferring dockerfile: 338B                                                                                           0.0s
 => [internal] load metadata for docker.io/cypress/browsers:latest                                                             4.2s
 => [internal] load .dockerignore                                                                                              0.0s
 => => transferring context: 2B                                                                                                0.0s
 => [1/6] FROM docker.io/cypress/browsers:latest@sha256:ff79e75249941c52c301821a7979db306e2659aa2d6038428bcf77c6f5f125e1     100.8s
 => => resolve docker.io/cypress/browsers:latest@sha256:ff79e75249941c52c301821a7979db306e2659aa2d6038428bcf77c6f5f125e1       0.0s
 => => sha256:661854d37a0b693c3f7de6a5efea7a53194e35fb4ccb2425f5d58453b1db4484 289.27kB / 289.27kB                             1.0s
 => => sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1 32B / 32B                                       1.0s
 => => sha256:f1ef7215e7c42b228f5d48b1594551cc32c02120b3d6d0a2e3b0976f829cc46e 2.35MB / 2.35MB                                 3.0s
 => => sha256:5220afb121527ecc04ab6a9023918d9a7299f7c122388566885f7cf2c12b83c8 203.06MB / 203.06MB                            40.8s
 => => sha256:d9953a4bfb08d33558778affab5ceb849d3d86c0956a5e4eff6f57e74eed16d2 260.27MB / 260.27MB                            82.9s
 => => sha256:8ab68d0982b4f08b7eaeaeba46c06dc972a514e7a94fe42f329f0caa13c0076b 209.23MB / 209.23MB                            93.0s
 => => sha256:4c5bd00093d23ff90e2ffcfe15cdc4a4d78e7d65574ccdba643999d8fe6bc305 2.27MB / 2.27MB                                 1.9s
 => => sha256:5eb21ac4195818a08c9dd28dcb3285e43aaa4f29bf9fc55137096f8edcdb502b 5.47kB / 5.47kB                                 0.3s
 => => sha256:1f4771fa55e3b652068d4918d975bc28ef83e9ef8bc23112417b72dd27c28877 58.18MB / 58.18MB                              46.3s
 => => sha256:c8309ee096f35721000e2938339ef723acdf304d9f65c5ccc501bf0b0094ac7f 159.66MB / 159.66MB                            25.7s
 => => sha256:0e4bc2bd6656e6e004e3c749af70e5650bac2258243eb0949dea51cb8b7863db 29.78MB / 29.78MB                              23.3s
 => => extracting sha256:0e4bc2bd6656e6e004e3c749af70e5650bac2258243eb0949dea51cb8b7863db                                      0.4s
 => => extracting sha256:c8309ee096f35721000e2938339ef723acdf304d9f65c5ccc501bf0b0094ac7f                                      1.9s
 => => extracting sha256:5eb21ac4195818a08c9dd28dcb3285e43aaa4f29bf9fc55137096f8edcdb502b                                      0.0s
 => => extracting sha256:1f4771fa55e3b652068d4918d975bc28ef83e9ef8bc23112417b72dd27c28877                                      1.1s
 => => extracting sha256:4c5bd00093d23ff90e2ffcfe15cdc4a4d78e7d65574ccdba643999d8fe6bc305                                      0.0s
 => => extracting sha256:8ab68d0982b4f08b7eaeaeba46c06dc972a514e7a94fe42f329f0caa13c0076b                                      1.8s
 => => extracting sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1                                      0.0s
 => => extracting sha256:d9953a4bfb08d33558778affab5ceb849d3d86c0956a5e4eff6f57e74eed16d2                                      2.5s
 => => extracting sha256:5220afb121527ecc04ab6a9023918d9a7299f7c122388566885f7cf2c12b83c8                                      2.0s
 => => extracting sha256:f1ef7215e7c42b228f5d48b1594551cc32c02120b3d6d0a2e3b0976f829cc46e                                      0.1s
 => => extracting sha256:661854d37a0b693c3f7de6a5efea7a53194e35fb4ccb2425f5d58453b1db4484                                      0.0s
 => [internal] load build context                                                                                              0.6s
 => => transferring context: 24.68MB                                                                                           0.6s
 => [2/6] WORKDIR /e2e                                                                                                         0.5s
 => [3/6] COPY package.json package-lock.json ./                                                                               0.1s
 => [4/6] RUN npm ci && npx cypress cache clear && npx cypress install                                                        62.5s
 => [5/6] COPY . ./                                                                                                            3.4s 
 => [6/6] RUN npx cypress verify                                                                                               2.1s 
 => exporting to image                                                                                                        25.0s 
 => => exporting layers                                                                                                       19.9s 
 => => exporting manifest sha256:5e23580c1c4103159319d6afa8531df430d6e7b577ccbeeb945b900fa3507afc                              0.0s 
 => => exporting config sha256:eafd32ee46fbad75286dece0e1ac4eed85213778422415428e49ecc5067fcd51                                0.0s 
 => => exporting attestation manifest sha256:92d07010e09d0261db58f2a377fce3851fc638289eb13a46ea945fbfb3fe2fe9                  0.0s
 => => exporting manifest list sha256:26a8c11ee7940aa0c4db10cdd5e17641545ffd9ab75f94a467578127ef4ed129                         0.0s
 => => naming to docker.io/library/cypress-ssl-fail:latest                                                                     0.0s
 => => unpacking to docker.io/library/cypress-ssl-fail:latest                                                                  5.0s

View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/io5gbid2kmkuxx9tld2nu1tdt

What's next:
    View a summary of image vulnerabilities and recommendations → docker scout quickview 

> test@0.0.0 test
> docker run --platform linux/amd64 cypress-ssl-fail npx cypress run --browser chrome --spec 'cypress/e2e/s3-fail-test.cy.js'


DevTools listening on ws://127.0.0.1:41407/devtools/browser/ba1528a4-0a5b-45ed-9f4c-1d2c3f5113b6

====================================================================================================

  (Run Starting)

  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ Cypress:        15.7.0                                                                         │
  │ Browser:        Chrome 143 (headless)                                                          │
  │ Node Version:   v24.11.1 (/usr/local/bin/node)                                                 │
  │ Specs:          1 found (s3-fail-test.cy.js)                                                   │
  │ Searched:       cypress/e2e/s3-fail-test.cy.js                                                 │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘


────────────────────────────────────────────────────────────────────────────────────────────────────
                                                                                                    
  Running:  s3-fail-test.cy.js                                                              (1 of 1)


  S3 SSL Fail Test
    ✓ Requests the S3 bucket URL with SSL issues (2850ms)


  1 passing (3s)


  (Results)

  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ Tests:        1                                                                                │
  │ Passing:      1                                                                                │
  │ Failing:      0                                                                                │
  │ Pending:      0                                                                                │
  │ Skipped:      0                                                                                │
  │ Screenshots:  0                                                                                │
  │ Video:        false                                                                            │
  │ Duration:     2 seconds                                                                        │
  │ Spec Ran:     s3-fail-test.cy.js                                                               │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘


====================================================================================================

  (Run Finished)


       Spec                                              Tests  Passing  Failing  Pending  Skipped  
  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ ✔  s3-fail-test.cy.js                       00:02        1        1        -        -        - │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘
    ✔  All specs passed!                        00:02        1        1        -        -        -  

[ConfusedCitizen]

@MikeMcC399 Would like to keep this open in the hopes something with a Mac doing Rosetta Emulation on docker have any thoughts on this. Assuming based on your response the problem might be related to the emulation causes issues on the network layer between the AMD64 Docker container and the host network or something like that. Not sure at this stage. Might try to reach out to the Docker team as well for their input as this is definitely really weird and probably a very specific problem.

[MikeMcC399]

@ConfusedCitizen

Did you test in your environment using arm64, without forcing --platform linux/amd64?

Which macOS version are you using on your host machine?

Cypress also runs natively, without Docker, in "macOS >=13.5 (Intel or Apple Silicon 64-bit (x64 or arm64))" according to Cypress documentation.

[MikeMcC399]

@ConfusedCitizen

I'm not familiar with SSL details, so I'm not going to be much help with resolving your issue, and as you mention, this may be an emulation issue.

Node.js 24 did include a breaking change for SSL which may or may not be related. See Open SSL.

BTW: If you are posting error logs, it is easier to read them if they are posted in text form, rather than as a screen shot. It also enables searching in text, and copying parts of the error message for further searching. A screen shot means re-typing to perform any further searches.

[ConfusedCitizen]

@MikeMcC399 I have tested it using the arm64 images and it works locally but then its at odds with other developers machines and our pipeline environment which uses linux causing problems with cypress snapshots as the browsers on different OS have slight rendering differences.

It appears to be resolved on M2 macs and above. I believe there's some documented issues about OpenSSL issues between M1 and above Macs being incompatible for some reason so I suspect theres an issue with the emulation and my computers network layer having some kind of encryption mismatch in this very specific scenario.

Closing the ticket as its such a weirdly specific issue that only affects M1 Macs running Cypress in docker w\ amd64 emulation and only within the browser used within.