title: Server received ssl alert 0 "close notify" as fatal error
body: <p>We have seen much more SSL error than before when we move to a new server. The total SSL error rate is not high. Many of them are:</p>
  
  <pre><code>error:140943E8:SSL routines:SSL3_READ_BYTES:reason(1000):s3_pkt.c:1256:SSL alert number 0
  </code></pre>
  
  <p>We finally found these requests are actually successful requests. Why these error was generated is that <strong>openssl</strong> found these were fatal error. Add more debug info show that:</p>
  
  <pre><code>ssl_callback_info:SSL_CB_READ_ALERT fatal error close notify
  </code></pre>
  
  <p>But from rfc2246:</p>
  
  <pre><code>7.2.1. Closure alerts
  
  The client and the server must share knowledge that the connection is
  ending in order to avoid a truncation attack. Either party may
  initiate the exchange of closing messages.
  
  close_notify
      This message notifies the recipient that the sender will not send
      any more messages on this connection. The session becomes
      unresumable if any connection is terminated without proper
      close_notify messages with level equal to warning.
  </code></pre>
  
  <p><strong>We are wondering if there some special clients send "alert 0" as fatal  .</strong> Or this related some known issue of openssl. We are using openssl-1.0.1e now. Before migration we used openssl-1.0.0-25.</p>
  
  <p>Any suggestions would be appreciated.</p>
  
  <p>Update:</p>
  
  <p>I investigated the access log and found almost all the "fatal alert 0" was sent by Safari on Apple devices(Mac, iPhone, iPad).</p>
  
  <p>Through the code of libsecurity_ssl which the library of SSL engine. I found that this library would send "fatal alert 0" in sometimes that was totally different with other SSL libraries, for example openssl, NSS.</p>
  
  <p>SSLFatalSessionAlert(SSL_AlertCloseNotify, ctx);</p>
  
  <p><a href="http://www.opensource.apple.com/source/libsecurity_ssl/libsecurity_ssl-32463/lib/sslRecord.c" rel="nofollow">http://www.opensource.apple.com/source/libsecurity_ssl/libsecurity_ssl-32463/lib/sslRecord.c</a></p>
  
  <p>This mostly occurred when Safari meet unexpected abort of the connection. As my server would not sent a "warning alert 0" to close the connection.</p>