SSl Errors

[Maxim Dounin]

Hello!

On Mon, Jan 21, 2019 at 11:59:25PM +0300, Алексей wrote:

>    I use nginx 1.13.6 as server for mutual tls auth with clients certs

Note that 1.13.6 is a mainline version which is not supported 
since release of 1.13.7 at 21 Nov 2017.  You may want to upgrade 
to a more recent version, e.g., latest mainline is 1.15.8.

>    During ab test I get errors ssl read failed(5) closing connection

Error 5 is SSL_ERROR_SYSCALL suggests that futher information is 
available in errno, and ab does not try to test/log errno.  You 
may want to use strace / ktrace / truss to find out which error 
actually happened.

>    In nginx log (debug mode) I get
> 
>    2019/01/21 23:50:01 [debug] 26#26: *27497 http check ssl handshake
>    2019/01/21 23:50:01 [debug] 26#26: *27497 http recv(): 1
>    2019/01/21 23:50:01 [debug] 26#26: *27497 https ssl handshake: 0x16
>    2019/01/21 23:50:01 [debug] 26#26: *27497 tcp_nodelay
>    2019/01/21 23:50:01 [debug] 26#26: *27497 SSL server name: "meteotravel.ru"
>    2019/01/21 23:50:01 [debug] 26#26: *27497 SSL_do_handshake: -1
>    2019/01/21 23:50:01 [debug] 26#26: *27497 SSL_get_error: 2
>    2019/01/21 23:50:01 [debug] 26#26: *27497 reusable connection: 0
>    2019/01/21 23:50:02 [debug] 26#26: *27497 SSL handshake handler: 0
>    2019/01/21 23:50:02 [debug] 26#26: *27497 SSL_do_handshake: -1
>    2019/01/21 23:50:02 [debug] 26#26: *27497 SSL_get_error: 5
>    2019/01/21 23:50:02 [info] 26#26: *27497 peer closed connection in SSL handshake while SSL handshaking, client: 10.244.5.0, server: 0.0.0.0:443

>From nginx point of view, the connection was closed by the client.  
The error as returned by OpenSSL is SSL_ERROR_SYSCALL, and errno 
is 0 so it is not logged.  This indicate a clean TCP-level 
connection close by the other side.

-- 
Maxim Dounin
http://mdounin.ru/