<div dir="ltr"><div><div><pre>Hello!
On Tue, Feb 25, 2014 at 04:34:34PM +0100, Juan Matías wrote:
><i> Hello everyone, I'm new here and this my first post in this mailing list,
</i>><i>
</i>><i> Maybe this is a frequently answered question but I could't find a solution.
</i>><i> Maybe is a "layer 8" issue.
</i>><i>
</i>><i> Right now, I have a Nginx(1.0.8) proxy running on Ubuntu 10.04 32bits,
</i>><i> OpenSSL 0.9.8 doing a https upstream on port 33195. Here is a piece of the
</i>><i> nginx.conf file:
</i>><i>
</i>><i> ......
</i>><i> location /external_services {
</i>><i> proxy_pass <a href="https://x.x.x.x:33195/external_service;">https://x.x.x.x:33195/external_service;</a>
</i>><i> allow x.x.x.x;
</i>><i> deny all;
</i>><i> }
</i>><i> ......
</i>><i>
</i>><i>
</i>><i> It is working, but I need to migrate this proxy to a new server. This new
</i>><i> server runs Ubuntu 12.04, OpenSSL 1.0.1 and Nginx 1.5.10.
</i>><i>
</i>><i> This server receive an <a href="http://myproxy/external_services">http://myproxy/external_services</a> request and proxy
</i>><i> it to <a href="https://x.x.x.x:33195/external_service;">https://x.x.x.x:33195/external_service;</a> (http to https)
</i>><i>
</i>><i> When I try to access <a href="http://myproxy/external_services">http://myproxy/external_services</a> on the new server, I
</i>><i> got a 502 error and I see this message in error.log :
</i>><i>
</i>><i> "peer closed connection in SSL handshake while SSL handshaking to
</i>><i> upstream"
</i>><i>
</i>><i> I found that I can connect(from the proxy server) to
</i>><i> <a href="https://x.x.x.x:33195/external_service">https://x.x.x.x:33195/external_service</a> using openssl, doing this:
</i>><i>
</i>><i> $ openssl s_client -connect <a href="https://x.x.x.x:33195/external_service-no_tls1_1">https://x.x.x.x:33195/external_service-no_tls1_1</a>
</i>><i>
</i>><i> I tried to disable TLSv1.1 in Nginx using the directive: ssl_protocols
</i>><i> SSLv3 TLSv1; but nothing change.
</i>
You have to use proxy_ssl_protocols, not ssl_protocols. See
<a href="http://nginx.org/r/proxy_ssl_protocols.">http://nginx.org/r/proxy_ssl_protocols.</a>
The proxy_ssl_ciphers directive may help, too, depending on what
exactly triggers the problem on your backend.
--
Maxim Dounin
<a href="http://nginx.org/">http://nginx.org/</a>
</pre><br>Thanks Maxim Dounin for the answer<br>I tried that but did not work.<br><br>I tried using directives on nginx config file but the issue continue. I
can't ensure but looks like Nginx was using TLSv1.1 or 1.2 anyway and
the SSL handshake failed. And I didn't find a way to disable this version of the protocol.<br><br></div>So I fixed the problem compiling nginx(1.0.15) from source using openSSL 0.9.8e. This version of OpenSSL doesnt support TLSv1.1. And that's works. I have no option, the provider that I'm dealing with doesn't support TLSv1.1 and they are not going to update his service.<br>
<br><br></div>Thanks,<br><div><div>Matías. <br>
</div></div></div>