Merge pull request #7052 from TheThingsNetwork/fix/lbs-read-headers-t…

…imeout

CHANGELOG.md

@@ -19,14 +19,16 @@ For details about compatibility between different releases, see the **Commitment
 
 ### Fixed
 
+- Increased the timeout for Basic Station gateways sending HTTP headers. There should now be enough time for embedded devices with little to no hardware acceleration to perform a TLS handshake. In particular, The Things Indoor Gateway can now connect to The Things Stack presenting a ECDSA certificate.
+
 ### Security
 
 ## [3.30.1] - unreleased
 
 ### Added
 
 - Support fine-grained NbTrans controls while using Dynamic ADR mode in the Console.
-- User bookmark listing now supports filtering bookmarks by entity type. 
+- User bookmark listing now supports filtering bookmarks by entity type.
   - This can be specified by setting `entity_types` field in `ListUserBookmarksRequest`.
 
 ### Fixed

pkg/gatewayserver/gatewayserver.go

@@ -335,9 +335,14 @@ func New(c *component.Component, conf *Config, opts ...Option) (gs *GatewayServe
 					defer lis.Close()
 
 					srv := http.Server{
-						Handler:           web,
-						ReadTimeout:       120 * time.Second,
-						ReadHeaderTimeout: 5 * time.Second,
+						Handler:     web,
+						ReadTimeout: 120 * time.Second,
+						// The ReadHeaderTimeout should be sufficiently long for embedded devices to perform the TLS handshake
+						// before headers can be sent.
+						// For example, The Things Indoor Gateway connecting via HTTPS to The Things Stack presenting a TLS server
+						// certificate using ECDSA, the TLS handshake typically takes up to 10 seconds because there is limited
+						// hardware acceleration as compared to RSA.
+						ReadHeaderTimeout: 30 * time.Second,
 						ErrorLog:          stdlog.New(stdio.Discard, "", 0),
 					}
 					go func() {