SSL negotiation failures causing 408 error to be returned

[bpiraeus]

The problem with that diagnosis, is that in this case, it's actually
causing failures on the client side. The client in question has a flash
game which pulls some amount of data over https, when these sessions
time out and hand out a 408, it causes the game itself to barf up a
lung. Additionally after pulling 12 hours of logs and doing UA matching,
while Chrome on Win7 base seems to be the major player, we find these as
well:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/5.0; SLCC1;
.NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; yie9)
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0;
yie9)
Mozilla/5.0 (Windows NT 6.0; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0;
SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media
Center PC 6.0; CPNTDF; .NET4.0C)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR
2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618;
WinNT-PAI 26.09.2009; .NET4.0C)
Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0;
NP06)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0;
SlimBrowser)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/5.0; SLCC1;
.NET CLR 2.0.50727; Media Center PC 5.0; MS-RTC EA 2; .NET CLR
3.5.30729; .NET CLR 3.0.30729; .NET4.0C; BRI/2)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;
Trident/5.0)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101
Firefox/11.0
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_4_11; en)
AppleWebKit/533.19.4 (KHTML, like Gecko) Version/4.1.3 Safari/533.19.4
Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0;
FunWebProducts)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0;
yie9)
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101
Firefox/11.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.50.2
(KHTML, like Gecko) Version/5.0.6 Safari/533.22.3
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)


The interesting bit is that the significant amount of these (when we
strip out Chrome) are MSIE on a Win7 base, which makes me inclined to
suspect something funny with Win 7, but there's at least 2 instances of
OS X in there, and 2 instances (FF 10.0.02 and FF 11) on NT 5.1 (XP
base)

If we throw out the OS X and XP ones as outliers due to something else
(people monkeying with settings, who knows), that leaves us with a
pretty clear indication that -something- in Win 7 has got some kind of
naughty behavior with SSL, but I'll be damned if I can come up with
anything. I spent half of last night trawling google for Win 7+SSL
issues and just didn't find anything of relevance.

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,225349,225368#msg-225368