Issue in ssl negociation

[brunoa]

Hi Maxim,

> 
> This may indicate different network paths, with
> some of them 
> filtering ICMP frag-needed packets, and others
> don't (or at least 
> doing MSS clamp).  Alternatively, blackhole
> detection might come 
> and magically fix things.
> 

Indeed, blackhole detection solved my issue. Thanks for your expertise
!

# echo 2 > /proc/sys/net/ipv4/tcp_mtu_probing

and also in sysctl.conf.

Now, TCP packets have a size of 564 octets (probably due to tcp_base_mss
default value), which may not be optimal but is ok for now.

Bruno

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,219756,219776#msg-219776