Request for help - curl not working in wordpress container

[cestnickell]

Hi All and thanks for all the work everyone does on Wordpress itself and also on the docker image.

I'm using wordpress:latest image, created using docker-compose on Docker 19.03.12 linux, arm (Rasberry Pi 4) It sits behind traefik 2.2 as a reverse proxy.

I'm not sure why the timing, but about two weeks ago I noticed that wordpress was no longer updating. I couldn't get the 5.7 update to download, and also couldn't download updates to any plugins.

The error returned by the WP admin interface is: "Update failed: Download failed. cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to downloads.wordpress.org:443"

When I try running 'curl https://wordpress.org' within the container it similarly fails:

'curl https://wordpress.org -v
[truncated]

• Trying 198.143.164.252...
• TCP_NODELAY set
• Expire in 200 ms for 4 (transfer 0x1fa48b0)
• Connected to wordpress.org (198.143.164.252) port 443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: none
  CApath: /etc/ssl/certs
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to wordpress.org:443
• Closing connection 0
  curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to wordpress.org:443

If I do the same curl requests outside the container and on the server itself, they are successful. If do the curl request with the insecure option added (-k) within the container, it is successful. (interestingly, the logs still show it doing all the handshakes and things)

There is no firewall on the server and the firewall on the router has been disabled.

My curl version in both the container and on my server 7.64.0 (arm-unknown-linux-gnueabihf)
My openssl version in both the container and the server is OpenSSL/1.1.1d

Things I've tried: restarting router, different router firewall settings, trying to update curl or openssl in the container (both report they are at latest version) recreating the container. None of them have produced any difference.

I'd wondered if it might be this issue: curl/curl#4624
But then it would be odd for it to affect the container but not the server?

Grateful for any suggestions! I suspect that it might be something works itself out in a future update. The server isn't essential and there is nothing particularly valuable on it, so just a workaround at this stage would be fine too, for example I'd even thought about just tweaking my class-wp-http-curl.php file to add the -k argument to all the curl requests.