title: How to debug and fix intermittent SSL 'connection reset by peer' error?
body: <p>We are having an occasional (1 in 100) error appear on our client (CentOS) when connecting to a server (Windows/IIS) over HTTPS. </p>
  
  <p>The error is: <code>SSL: Connection reset by peer</code>.</p>
  
  <p>Running <code>openssl s_client -connect example.com:443 -prexit</code> works 99% of the time but sometimes returns <code>write:errno=104</code> confirming the connection reset issue. </p>
  
  <p>Interestingly the handshake is a different (smaller) size when the connection is reset and fails but I cannot see how to actually see the handshake.</p>
  
  <p>A successful connection is: <code>SSL handshake has read 5308 bytes and written 319 bytes</code></p>
  
  <p>A failed connection is: <code>SSL handshake has read 5249 bytes and written 198 bytes</code></p>
  
  <p>The same protocol (TLS) and cipher is used at all times. </p>
  
  <p>Server side, the error in Windows Event log is: <code>A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 20. The Windows SChannel error state is 960.</code></p>
  
  <p>Fatal error code 20 is <code>Received a record with an incorrect MAC. This message is always fatal.</code>. </p>
  
  <p>Can anyone help debug this further? As it's only an occasional issue I am struggling to think why it would happen. Thanks!</p>