# 504 SSL\_do\_handshake() failed

**URL:** <https://www.ruby-forum.com/t/504-ssl-do-handshake-failed/216600>\
**Category:** NGINX\
**Created:** [February 9, 2012, 2:06am UTC](https://www.ruby-forum.com/t/504-ssl-do-handshake-failed/216600 "2012-02-09T02:06:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [February 9, 2012, 2:06am UTC](https://www.ruby-forum.com/t/504-ssl-do-handshake-failed/216600/1 "2012-02-09T02:06:53Z")

</div>

A similar problem to below case occurred in mine.

> **[Re: Intermittent "504 SSL\_do\_handshake() failed"](https://forum.nginx.org/read.php?2,144108,222098#msg-222098)**
>
> I seem to be having a problem with the secure reverse proxy. I have a "Synology Disk Station" that hosts Apache virtual servers with one being an administration web panel, and the other "https://192.168.2.2/photo" being a...

Following is the ssl server configuration.  
At first I used AJP.  
But after I could not find a corresponding directive to  
proxy\_ssl\_session\_reuse, I changed to proxy.

upstream loadbalancer {  
server 127.0.0.1:8080;

keepalive 100;  
}

server {  
listen 443 default ssl;  
ssl on;

…

location / {  
#access\_log off;  
#ajp\_pass loadbalancer;  
proxy\_pass [http://loadbalancer](http://loadbalancer);  
proxy\_ssl\_session\_reuse off;  
}  
}

Here’s the error log:  
2012/02/08 15:03:49 [info] 13273#0: \*1 SSL\_do\_handshake() failed (SSL:  
error:14094416:SSL routines:SSL3\_READ\_BYTES:sslv3 alert certificate  
unknown) while SSL handshaking,

Any help would be greatly appreciated!  
Thanks in advance!

Posted at Nginx Forum:

> **[504 SSL\_do\_handshake() failed](https://forum.nginx.org/read.php?2,222128,222128#msg-222128)**
>
> A similar problem to below case occurred in mine. http://forum.nginx.org/read.php?2,144108,222098#msg-222098 Following is the ssl server configuration. At first I used AJP. But after I could not find a corresponding directive to...

---

<div class="post-metadata">

**Author:** ![zealot83](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e47c2d/32.png) [@zealot83](https://www.ruby-forum.com/u/zealot83)\
**Post date:** [February 9, 2012, 7:10am UTC](https://www.ruby-forum.com/t/504-ssl-do-handshake-failed/216600/2 "2012-02-09T07:10:54Z")

</div>

Does [OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008] have any problem with  
nginx-0.8.54?

Posted at Nginx Forum:

> **[Re: 504 SSL\_do\_handshake() failed](https://forum.nginx.org/read.php?2,222128,222133#msg-222133)**
>
> A similar problem to below case occurred in mine. http://forum.nginx.org/read.php?2,144108,222098#msg-222098 Following is the ssl server configuration. At first I used AJP. But after I could not find a corresponding directive to...

---

<div class="post-metadata">

**Author:** ![zealot83](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e47c2d/32.png) [@zealot83](https://www.ruby-forum.com/u/zealot83)\
**Post date:** [February 9, 2012, 10:15am UTC](https://www.ruby-forum.com/t/504-ssl-do-handshake-failed/216600/3 "2012-02-09T10:15:39Z")

</div>

09 февраля 2012, 10:10 от “zealot83” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> Does [OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008] have any problem with  
> nginx-0.8.54?

There have been a couple of OpenSSL-related bugfixes since,  
so try upgrading both OpenSSL and nginx first. You should  
definitely upgrade OpenSSL because the version you’re using  
has a serious vulnerability:

[http://www.cvedetails.com/cve/CVE-2010-4180/](http://www.cvedetails.com/cve/CVE-2010-4180/)

Max

---

<div class="post-metadata">

**Author:** ![zealot83](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e47c2d/32.png) [@zealot83](https://www.ruby-forum.com/u/zealot83)\
**Post date:** [February 9, 2012, 2:48am UTC](https://www.ruby-forum.com/t/504-ssl-do-handshake-failed/216600/4 "2012-02-09T02:48:54Z")

</div>

09 февраля 2012, 05:06 от “zealot83” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> #access\_log off;  
> #ajp\_pass loadbalancer;  
> proxy\_pass [http://loadbalancer](http://loadbalancer);  
> proxy\_ssl\_session\_reuse off;  
> }  
> }
> 
> Here’s the error log:  
> 2012/02/08 15:03:49 [info] 13273#0: \*1 SSL\_do\_handshake() failed (SSL:  
> error:14094416:SSL routines:SSL3\_READ\_BYTES:sslv3 alert certificate  
> unknown) while SSL handshaking,

You’re probably using a self-signed certificate?  
First sync the time on all the servers and clients  
using NTP, then try using different browsers  
(other than Firefox and IE) and curl.

If the problem persists, sync the time on the  
server again and regenerate the certificate.  
If that doesn’t help, post your complete nginx.conf,  
the output of “nginx -V” and “uname -a”, and the  
the version of OpenSSL on the server where you  
compiled nginx.

Max