<!doctypehtml PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang=EN xml:lang=EN xmlns=http://www.w3.org/1999/xhtml><title>
   SSL handshake failure
  </title><link href=https://forum.nginx.org/css.php?15,css media=screen rel=stylesheet><link href=https://forum.nginx.org/css.php?15,css_print media=print rel=stylesheet><script src=https://forum.nginx.org/javascript.php?15></script><link href=https://forum.nginx.org/feed.php?15,266543,type=rss rel=alternate title=RSS type=application/rss+xml><meta content="Hello. I am having a problem with establishing SSL connection between an Apache proxy and Nginx, connection fails during handshake with Alert 21 message. Other clients have no problem connecting to Nginx, only proxy does. I have tried to make sense of the tcpdump output "name=description><body onload><div id=phorum><div class=logged-out id=user-info><span class=welcome> Welcome! </span><a class="icon icon-key-go"href=https://forum.nginx.org/login.php?15> Log In </a><a class="icon icon-user-add"href=https://forum.nginx.org/register.php?15> Create A New Profile </a></div><div id=logo><a href=https://forum.nginx.org/> <img alt=Phorum border=0 height=25 src=https://forum.nginx.org/templates/emerald/images/logo.png width=111> </a></div><div id=breadcrumb><a href=https://forum.nginx.org/index.php> Home </a> > <a href=https://forum.nginx.org/index.php?7 rel=breadcrumb-folder[7]> Nginx Related Forums </a> > <a href=https://forum.nginx.org/list.php?15 rel=breadcrumb-forum[15]> Other discussion </a> > Topic</div><div class=icon-zoom id=search-area><form action=https://forum.nginx.org/search.php?15 id=header-search-form><input name=forum_id type=hidden value=15><input name=posting_token:post type=hidden value=9c14c04fada64d09f5a7785ada00b36b><input name=phorum_page type=hidden value=search><input name=match_forum type=hidden value=ALL><input name=match_dates type=hidden value=365><input name=match_threads type=hidden value=0><input name=match_type type=hidden value=ALL><input class=styled-text name=search size=20><input class=styled-button type=submit value=Search><br><a href=https://forum.nginx.org/search.php?15> Advanced </a></form></div><div id=page-info><h1 class=heading>SSL handshake failure</h1><div class=description>Posted by <a href=https://forum.nginx.org/profile.php?15,17266> darkmagus </a>  </div></div><div class=nav><a class="icon icon-folder"href=https://forum.nginx.org/index.php> Forum List </a><a class="icon icon-list"href=https://forum.nginx.org/list.php?15> Message List </a><a class="icon icon-comment-add"href=https://forum.nginx.org/posting.php?15> New Topic </a></div><div class=message><div class=generic><table border=0 cellspacing=0><tbody><tr><td width=100%><div class="message-author icon-user"><a href=https://forum.nginx.org/profile.php?15,17266> darkmagus </a></div> <small> <strong> <a href=https://forum.nginx.org/read.php?15,266543,266543#msg-266543 rel=nofollow> SSL handshake failure </a> </strong> <br> April 30, 2016 08:07AM </small><td class=message-user-info nowrap=nowrap>Registered: 5 years ago <br> Posts: 3</table></div><div class=message-body>Hello. <br><br> I am having a problem with establishing SSL connection between an Apache proxy and Nginx, connection fails during handshake with Alert 21 message. <br> Other clients have no problem connecting to Nginx, only proxy does. <br> I have tried to make sense of the tcpdump output but would appreciate your help in finding out why Nginx rejects the connection. <br><br> Nginx info: <br><br> nginx version: nginx/1.8.1 <br> built with OpenSSL 1.0.1f 6 Jan 2014 <br><br><br> Client Hello: <br><br> Secure Sockets Layer <br> TLSv1.2 Record Layer: Handshake Protocol: Client Hello <br> Content Type: Handshake (22) <br> Version: TLS 1.2 (0x0303) <br> Length: 91 <br> Handshake Protocol: Client Hello <br> Handshake Type: Client Hello (1) <br> Length: 87 <br> Version: TLS 1.2 (0x0303) <br> Random <br> GMT Unix Time: Jul 28, 1975 11:49:59.000000000 CET <br> Random Bytes: 5803affbe1677147d908839b735d75f93cd7ba62030d8e8a... <br> Session ID Length: 0 <br> Cipher Suites Length: 28 <br> Cipher Suites (14 suites) <br> Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) <br> Cipher Suite: TLS_FALLBACK_SCSV (0x5600) <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) <br> Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c) <br> Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) <br> Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c) <br> Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) <br> Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) <br> Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) <br> Compression Methods Length: 1 <br> Compression Methods (1 method) <br> Compression Method: null (0) <br> Extensions Length: 18 <br> Extension: elliptic_curves <br> Type: elliptic_curves (0x000a) <br> Length: 8 <br> Elliptic Curves Length: 6 <br> Elliptic curves (3 curves) <br> Elliptic curve: secp256r1 (0x0017) <br> Elliptic curve: secp384r1 (0x0018) <br> Elliptic curve: secp521r1 (0x0019) <br> Extension: ec_point_formats <br> Type: ec_point_formats (0x000b) <br> Length: 2 <br> EC point formats Length: 1 <br> Elliptic curves point formats (1) <br><br><br><br> Server response: <br><br> Secure Sockets Layer <br> TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Handshake Failure) <br> Content Type: Alert (21) <br> Version: TLS 1.2 (0x0303) <br> Length: 2 <br> Alert Message <br> Level: Fatal (2) <br> Description: Handshake Failure (40) <br><br><br> I have tested the issue with a default nginx configuration and with a specific set of ciphers but with no success. <br> Server is on a private network with no access to Internet and I control only the server with nginx. <br><br> Any help would be appreciated. <div class=message-options><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266543#REPLY rel=nofollow> Reply </a><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266543,quote=1#REPLY rel=nofollow> Quote </a></div></div></div><a name=msg-266545> </a><div class=message><div class=generic><table border=0 cellspacing=0><tbody><tr><td width=100%><div class="message-author icon-user"><a href=https://forum.nginx.org/profile.php?15,17266> darkmagus </a></div> <small> <strong> <a href=https://forum.nginx.org/read.php?15,266543,266545#msg-266545 rel=nofollow> Re: SSL handshake failure </a> </strong> <br> April 30, 2016 08:48AM </small><td class=message-user-info nowrap=nowrap>Registered: 5 years ago <br> Posts: 3</table></div><div class=message-body>Also, the nginx log excerpt: <br><br> 2016/04/30 14:36:55 [info] 25632#0: *1 SSL_do_handshake() failed (SSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher) while SSL handshaking, client: x.x.x.x, server: y.y.y.y:443 <div class=message-options><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266545#REPLY rel=nofollow> Reply </a><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266545,quote=1#REPLY rel=nofollow> Quote </a></div></div></div><a name=msg-266546> </a><div class=message><div class=generic><table border=0 cellspacing=0><tbody><tr><td width=100%><div class="message-author icon-user"><a href=https://forum.nginx.org/profile.php?15,7488> itpp2012 </a></div> <small> <strong> <a href=https://forum.nginx.org/read.php?15,266543,266546#msg-266546 rel=nofollow> Re: SSL handshake failure </a> </strong> <br> April 30, 2016 09:25AM </small><td class=message-user-info nowrap=nowrap><strong> Admin </strong> <br> Registered: 9 years ago <br> Posts: 1,277</table></div><div class=message-body>Maybe this http://stackoverflow.com/questions/33806038/nginx-error-no-shared-cipher-but-there-are <br><br> --- <br> nginx for Windows http://nginx-win.ecsds.eu/ <div class=message-options><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266546#REPLY rel=nofollow> Reply </a><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266546,quote=1#REPLY rel=nofollow> Quote </a></div></div></div><a name=msg-266549> </a><div class=message><div class=generic><table border=0 cellspacing=0><tbody><tr><td width=100%><div class="message-author icon-user"><a href=https://forum.nginx.org/profile.php?15,17266> darkmagus </a></div> <small> <strong> <a href=https://forum.nginx.org/read.php?15,266543,266549#msg-266549 rel=nofollow> Re: SSL handshake failure </a> </strong> <br> April 30, 2016 02:09PM </small><td class=message-user-info nowrap=nowrap>Registered: 5 years ago <br> Posts: 3</table></div><div class=message-body>Thanks for the suggestion. <br> Unfortunately, the issue persists. <br><br> According to tcpdump output and RFC (if I interpreted it correctly), the issue occurs because the client and the server cannot agree about communication algorithms, conversation does not even reach the certificate exchange stage. <br><br> " <br> https://tools.ietf.org/html/rfc5246#section-7.4.1.2 <br><br> In the event that a client requests additional functionality using extensions, and this functionality is not supplied by the server, the client MAY abort the handshake. A server MUST accept ClientHello messages both with and without the extensions field, and (as for all other messages) it MUST check that the amount of data in the message precisely matches one of these formats; if not, then it MUST send a fatal "decode_error" alert. <br> " <br><br> " <br> https://tools.ietf.org/html/rfc5246#section-7.4.1.3 <br><br> The server will send this message in response to a ClientHello message when it was able to find an acceptable set of algorithms. If it cannot find such a match, it will respond with a handshake failure alert. <br> " <br><br> Excerpt from a successful ServerHello on the same server (localhost request): <br><br> TLSv1.2 Record Layer: Handshake Protocol: Server Hello <br> Content Type: Handshake (22) <br> Version: TLS 1.2 (0x0303) <br> Length: 94 <br> Handshake Protocol: Server Hello <br> Handshake Type: Server Hello (2) <br> Length: 90 <br> Version: TLS 1.2 (0x0303) <br> Random <br> GMT Unix Time: Jan 29, 2038 13:50:53.000000000 CET <br> Random Bytes: a5c11896aed0b85c783524c7921518e9c6f6cb4f1f5ed28e... <br> Session ID Length: 32 <br> Session ID: c949118cdcc40d69afd8675a7c6471b61b041a71d4fd3e8f... <br> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) <br> Compression Method: null (0) <br> Extensions Length: 18 <br> Extension: renegotiation_info <br> Type: renegotiation_info (0xff01) <br> Length: 1 <br> Renegotiation Info extension <br> Extension: ec_point_formats <br> Type: ec_point_formats (0x000b) <br> Length: 4 <br> EC point formats Length: 3 <br> Elliptic curves point formats (3) <br> Extension: Heartbeat <br> Type: Heartbeat (0x000f) <br> Length: 1 <br> Mode: Peer allowed to send requests (1) <br><br><br> In regards to requirements sent by the proxy, openssl does not show an issue: <br><br> # openssl ciphers | grep -q ECDHE-RSA-AES256-GCM-SHA384; echo $? <br> 0 <br><br> # openssl ecparam -list_curves | grep -e secp256r1 -e secp384r1 -e secp521r1 <br> secp384r1 : NIST/SECG curve over a 384 bit prime field <br> secp521r1 : NIST/SECG curve over a 521 bit prime field <br><br><br> Maybe I am overthinking this and there is a simple reason for failure in communication between the two servers but I just do not see it. <div class=message-options><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266549#REPLY rel=nofollow> Reply </a><a class="icon icon-comment-add"href=https://forum.nginx.org/read.php?15,266543,266549,quote=1#REPLY rel=nofollow> Quote </a></div></div></div><div class=nav><a class="icon icon-prev"href=https://forum.nginx.org/read.php?15,1462039773,newer> Newer Topic </a><a class="icon icon-next"href=https://forum.nginx.org/read.php?15,1462039773,older> Older Topic </a></div><div class=nav id=thread-options><a class="icon icon-printer"href=https://forum.nginx.org/read.php?15,266543,printview,page=1 target=_blank> Print View </a><a class="icon icon-feed"href=https://forum.nginx.org/feed.php?15,266543,type=rss> RSS </a></div><a name=REPLY> </a><div class=information>Sorry, only registered users may post in this forum. <p><a href=https://forum.nginx.org/login.php?15> Click here to login </a></div><div class="generic mod_onlineusers"><h1>Online Users</h1><div class=onlineusers_users><a href=https://forum.nginx.org/profile.php?15,23068> greenwar </a></div><div class=onlineusers_guests>Guests: 76</div><div class=onlineusers_records><div class=onlineusers_record>Record Number of Users: 6 on February 13, 2018</div><div class=onlineusers_record>Record Number of Guests: 421 on December 02, 2018</div></div></div><script>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); 
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script>try {
var pageTracker = _gat._getTracker("UA-3932046-10");
pageTracker._trackPageview();
} catch(err) {}</script><div id=footer-plug>This forum is powered by <a href=http://www.phorum.org/ target=_blank> Phorum </a> .</div><table align=center><tbody><tr><td><a href=http://nginx.org/ target=_blank> <img alt="Powered by nginx"title="Powered by nginx"src=images/nginx.gif> </a><td>    <td><a href=http://freebsd.org/ target=_blank> <img alt="Powered by FreeBSD"title="Powered by FreeBSD"src=images/powerlogo.gif> </a><td>    <td><a href=http://php.net/ target=_blank> <img alt="PHP Powered"title="PHP Powered"src=images/php-med-trans-light.gif> </a><td>    <td><a href=https://mariadb.org/ target=_blank> <img alt="Powered by MariaDB"title="Powered by MariaDB"src=images/mariadb.png> </a><td>    <td> <a href=http://ipv6-test.com/validate.php?url=referer target=_blank> <img alt="ipv6 ready"title="ipv6 ready"src=images/button-ipv6-big.png> </a> </table></div>