Connectivity Issues

Diagnosing and resolving synchronizer connection failures and TLS errors

Connectivity failures prevent your validator from communicating with the synchronizer. The symptoms vary — from outright connection refusals to subtle TLS handshake errors — but the diagnostic approach is consistent.

Cannot Connect to Synchronizer

If your validator logs show:

Request failed for sequencer. Is the server running?

or

SEQUENCER_SUBSCRIPTION_LOST: Lost subscription to sequencer

Work through these checks in order.

1. Verify the Sequencer URL

Confirm that your configuration points to the correct sequencer endpoint for your target network:

• DevNet: https://sequencer.dev.sync.global
• TestNet: https://sequencer.test.sync.global
• MainNet: https://sequencer.sync.global

A common mistake is using the scan URL (https://scan.sv-2...) instead of the SV sponsor URL during onboarding. The scan URL is for read-only network data, not for validator registration.

2. Test Network Reachability

# DNS resolution
dig +short sequencer.sync.global

# TCP connectivity
nc -zv sequencer.sync.global 443

# Full TLS handshake
openssl s_client -connect sequencer.sync.global:443 -servername sequencer.sync.global </dev/null

If nc times out, a firewall or security group is blocking egress on port 443.

3. Check Firewall and Security Groups

Your validator requires outbound HTTPS on port 443 to the synchronizer. If you run in a cloud environment, verify:

• The security group attached to your instance or pod allows outbound TCP/443.
• No network ACL is blocking the traffic.
• If you use an HTTP proxy, Canton supports proxy configuration via JVM system properties (-Dhttps.proxyHost, -Dhttps.proxyPort).

TLS Handshake Failures

TLS errors typically produce log messages like:

io.grpc.StatusRuntimeException: UNAVAILABLE: io exception
Channel Pipeline: [SslHandler#0, ...]
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed

Certificate Expiry

Check whether the server certificate has expired:

openssl s_client -connect sequencer.sync.global:443 -servername sequencer.sync.global 2>/dev/null \
  | openssl x509 -noout -dates

If the certificate has expired and you control it (e.g., for your own validator’s TLS termination), renew it and restart the TLS-terminating proxy or ingress controller.

CA Trust Chain

If you see PKIX path building failed, the validator’s JVM does not trust the server’s certificate authority. Possible fixes:

• Import the CA certificate into the JVM truststore:

  keytool -importcert -alias myca -file ca-cert.pem \
    -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
  

• For Kubernetes, mount the CA bundle as a volume and set JAVA_OPTS:

  env:
    - name: JAVA_OPTS
      value: "-Djavax.net.ssl.trustStore=/etc/ssl/truststore.jks"
  

Hostname Mismatch

If the certificate’s Subject Alternative Name (SAN) does not include the hostname you are connecting to, the handshake will fail. Verify with:

openssl s_client -connect sequencer.sync.global:443 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName