<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Provide SSL logs from the client side - if you can, using OpenSSL
and its `s_connect` framework or similar to get the actual SSL
handshake errors/logs. Chances are something's wrong with the
handshake or your cert. (since I can't scan your infra directly
yourself, you'll have to get detailed SSL connection information
to the NGINX server first using some other tool)<br>
</p>
<div class="moz-cite-prefix">On 11/19/20 1:31 PM, sachingp wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2a0f9e6791f651ce16cacc1e36934813.NginxMailingListEnglish@forum.nginx.org">
<pre class="moz-quote-pre" wrap="">Hi - We are using Nginx as a reverse proxy with SSL as a termination point
Call flow
Network Load Balancer (TCP) --> Nginx(SSL Termination) --> Vertx Servers
(HTTP)
This is the config we use, fairly standard
upstream xyz {
server 127.0.0.1:8080;
keepalive 4096;
}
server {
listen 80;
listen 443 ssl;
ssl_certificate /etc/ssl/certs/bundle.crt;
ssl_certificate_key /etc/ssl/private/nginx-digicert.key;
# ssl_handshake_timeout 10s;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 4h;
# ssl_handshake_timeout 30s;
server_name _;
root /usr/share/nginx/html;
access_log /var/log/nginx/raps-access.log timed_combined buffer=8k
flush=1m;
#access_log off;
# only log critical errors
error_log /var/log/nginx/raps-error.log info;
location / {
proxy_pass <a class="moz-txt-link-freetext" href="http://xyz">http://xyz</a>;
proxy_pass_request_headers on;
proxy_ssl_server_name on;
proxy_http_version 1.1;
proxy_ssl_session_reuse on;
proxy_set_header Host $host;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
We see a lot of SSL handshake errors
2020/11/19 18:28:08 [info] 5784#0: *5771518 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.196, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5786#0: *5771519 peer closed connection in SSL
handshake while SSL handshaking, client: 158.85.210.39, server: 0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771520 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.201, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5786#0: *5771521 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.198, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771522 peer closed connection in SSL
handshake while SSL handshaking, client: 169.54.155.4, server: 0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771524 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.202, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5784#0: *5771525 peer closed connection in SSL
handshake while SSL handshaking, client: 158.85.210.39, server: 0.0.0.0:443
2020/11/19 18:28:08 [info] 5784#0: *5771527 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.212, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5786#0: *5771528 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.202, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5783#0: *5771526 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.212, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771529 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.204, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771530 peer closed connection in SSL
handshake while SSL handshaking, client: 169.54.155.82, server: 0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771531 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.216, server:
0.0.0.0:443
2020/11/19 18:28:08 [info] 5785#0: *5771533 peer closed connection in SSL
handshake while SSL handshaking, client: 169.53.151.201, server:
0.0.0.0:443
Mostly this code
2020/11/19 18:15:00 [debug] 5525#0: *5703427 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703640 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5525#0: *5703079 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5525#0: *5702872 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703173 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703406 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703705 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703764 SSL_get_error: 5
2020/11/19 18:15:00 [debug] 5524#0: *5703765 SSL_get_error: 5
2020/11/19 18:15:00 [debug] 5525#0: *5703766 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5525#0: *5703632 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703406 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5523#0: *5703177 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5523#0: *5703357 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5524#0: *5703173 SSL_get_error: 2
2020/11/19 18:15:00 [debug] 5523#0: *5703627 SSL_get_error: 2
Please share your experience or thoughts asap
Posted at Nginx Forum: <a class="moz-txt-link-freetext" href="https://forum.nginx.org/read.php?2,290010,290010#msg-290010">https://forum.nginx.org/read.php?2,290010,290010#msg-290010</a>
_______________________________________________
nginx mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx@nginx.org">nginx@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a>
</pre>
</blockquote>
</body>
</html>