Numerous TLS handshake errors

[col-muffin]

Example from the webhook listener log:
[webhook] 2025/11/13 11:42:47 http: TLS handshake error from 127.0.0.1:58399: EOF [webhook] 2025/11/13 11:43:50 http: TLS handshake error from 127.0.0.1:58409: EOF [webhook] 2025/11/13 11:44:53 http: TLS handshake error from 127.0.0.1:58418: EOF [webhook] 2025/11/13 11:45:56 http: TLS handshake error from 127.0.0.1:58431: EOF [webhook] 2025/11/13 11:46:58 http: TLS handshake error from 127.0.0.1:58441: EOF [webhook] 2025/11/13 11:48:01 http: TLS handshake error from 127.0.0.1:58452: EOF [webhook] 2025/11/13 11:49:04 http: TLS handshake error from 127.0.0.1:58462: EOF [webhook] 2025/11/13 11:50:06 http: TLS handshake error from 127.0.0.1:58472: EOF [webhook] 2025/11/13 11:51:09 http: TLS handshake error from 127.0.0.1:58481: EOF [webhook] 2025/11/13 11:52:12 http: TLS handshake error from 127.0.0.1:58491: EOF [webhook] 2025/11/13 11:53:14 http: TLS handshake error from 127.0.0.1:56099: EOF [webhook] 2025/11/13 11:54:17 http: TLS handshake error from 127.0.0.1:63011: EOF [webhook] 2025/11/13 11:55:19 http: TLS handshake error from 127.0.0.1:63018: EOF [webhook] 2025/11/13 11:56:22 http: TLS handshake error from 127.0.0.1:61999: EOF [webhook] 2025/11/13 11:57:23 http: TLS handshake error from 127.0.0.1:62009: EOF [webhook] 2025/11/13 11:58:26 http: TLS handshake error from 127.0.0.1:62018: EOF [webhook] 2025/11/13 11:59:28 http: TLS handshake error from 127.0.0.1:62026: EOF

I've confirmed via sysmon that these are being generated from webhook.exe. Does anyone know what would be causing this and how to fix?

[adnanh]

Looks to me like webhook is running on http, but you're trying to access it via https?

[col-muffin]

Classified as Confidential Unless I’m doing something wrong, it should be launching with HTTPS. This is the string I use to launch it: # Launch webhook.exe with all parameters & "C:\webhook_listener\webhook.exe" -hooks "C:\_Git\hubwisetech\root\_PRODUCTION\Underpinning\webhook_listener\hooks.json" -secure -port 443 -cert "C:\webhook_listener\hubwisetech_wildcard.pem" -key "C:\webhook_listener\STAR.hubwisetech.com.key" -logfile "C:\webhook_listener\logs\webhook_listener.log" [cid:hubwise-rgb_5bd249d4-0302-45e5-ac00-b1b163a9d049.png]<https://www.hubwisetech.com/> Jake Molko | Operations [cid:mobile_blue_1398eb63-0736-4fbe-8dbd-e9682e4dc28c.png] (402) 520-7069<tel:(402)%20520-7069> [cid:phone_blue_70aafc83-fbb4-4d05-b7e8-3b0f2d87c98c.png] (402) 339-7441<tel:(402)%20339-7441> [cid:untitled_0f4d0bec-db2c-40e6-b3c5-cd8284765062.png] ***@***.***?anonymous&ep=plink> Schedule a ***@***.***?anonymous&ep=plink> [cid:fb_blue_a3ba29d5-775c-45bd-8e39-859e9de48b9d.png]<https://www.facebook.com/HubWiseTech/> [cid:linkedin_blue_5007df27-dbcf-4068-bcda-531fab082ba6.png] <https://www.linkedin.com/company/hubwisetech> [cid:maps_pin_fullcolor-x1000(4)_c710a93d-2abb-4109-963a-24a4c6b04c0e.png] <https://g.page/HubWiseTechnology?share> [cid:computer-icon_blue_6ff767a1-2695-4b8b-8724-de35c28c6f86.png] Client Portal<https://hub.hubwisetech.com> From: Adnan Hajdarević ***@***.***> Date: Thursday, November 27, 2025 at 1:11 PM To: adnanh/webhook ***@***.***> Cc: Jake Molko ***@***.***>, Author ***@***.***> Subject: Re: [adnanh/webhook] Numerous TLS handshake errors (Discussion #742) CAUTION:This email originated from outside of the organization. Looks to me like webhook is running on http, but you're trying to access it via https? — Reply to this email directly, view it on GitHub<#742 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A7WEMAGFHJCRQJAKLB3MTOL365SJHAVCNFSM6AAAAACMA62WT2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMJQGAYTOOI>. You are receiving this because you authored the thread.