# Bad Decompression error after default ssl\_session\_timeout

**URL:** <https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929>\
**Category:** NGINX\
**Created:** [May 22, 2012, 9:16am UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929 "2012-05-22T09:16:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurdipe\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b77776/32.png) [@Gurdipe\_D](https://www.ruby-forum.com/u/Gurdipe_D)\
**Post date:** [May 22, 2012, 9:16am UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929/1 "2012-05-22T09:16:27Z")

</div>

Hi,

I have an LB setup with nginx for an ssl enabled site which load balance  
with 2 apache servers. All the servers are CentOS5.5\* and OpenSSL  
0.9.8e-fips-rhel5 01 Jul 2008. Also we are using the same SSL  
certificate on all the 3 servers.

It does load balance perfectly untill 5m. After that it raises an  
error:

[crit] 5179#0: \*6 SSL\_do\_handshake() failed (SSL: error:1408F06B:SSL  
routines:SSL3\_GET\_RECORD:bad decompression) while SSL handshaking to  
upstream, client: clientip, server: [lb.abcd.net](http://lb.abcd.net), request: “GET /search/  
HTTP/1.1”, upstream: “[https://server1-ip:443/search/](https://server1-ip:443/search/)”, host:  
“[lb.abcd.net](http://lb.abcd.net)”

This error happens for both server1 and server2. After this, the load  
balancer is not working.

The following are the nginx conf.

http {  
include mime.types;  
default\_type application/octet-stream;  
autoindex off;  
ssi off;  
server\_tokens off;

```
log_format main '$remote_addr [$time_local] - "$request" - '
                  '$status - $body_bytes_sent - "$http_referer"';

log_format load_b '$remote_addr [$time_local] - "$request" - $status

```

- ’  
'worker\_addr $upstream\_addr - ’  
'worker\_status $upstream\_status - ’  
'worker\_response\_time $upstream\_response\_time - ’  
'total\_processing\_time $request\_time - ’  
‘content\_type $upstream\_http\_content\_type’;

location / {  
proxy\_pass [https://loadbalancer](https://loadbalancer);  
access\_log logs/access\_lb.log load\_b;  
}

```
    error_page 403 templates/403.html;
    error_page 404 templates/404.html;
    error_page 500 502 503 504 /50x.html;

    location = /50x.html {
        alias templates/500.html;
    }
}

```

}

What can be the issue? Thanks in advance.

Posted at Nginx Forum:

> **[Bad Decompression error after default ssl\_session\_timeout](https://forum.nginx.org/read.php?2,226705,226705#msg-226705)**
>
> Hi, I have an LB setup with nginx for an ssl enabled site which load balance with 2 apache servers. All the servers are CentOS5.5\* and OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008. Also we are using the same SSL certificate on all the 3 servers. It does...

---

<div class="post-metadata">

**Author:** ![lima](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e5b9ba/32.png) [@lima](https://www.ruby-forum.com/u/lima)\
**Post date:** [May 22, 2012, 7:28pm UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929/2 "2012-05-22T19:28:24Z")

</div>

Hello!

On Tue, May 22, 2012 at 03:15:31AM -0400, lima wrote:

> [crit] 5179#0: \*6 SSL\_do\_handshake() failed (SSL: error:1408F06B:SSL  
> routines:SSL3\_GET\_RECORD:bad decompression) while SSL handshaking to  
> upstream, client: clientip, server: [lb.abcd.net](http://lb.abcd.net), request: “GET /search/  
> HTTP/1.1”, upstream: “[https://server1-ip:443/search/](https://server1-ip:443/search/)”, host:  
> “[lb.abcd.net](http://lb.abcd.net)”
> 
> This error happens for both server1 and server2. After this, the load  
> balancer is not working.

[…]

> What can be the issue? Thanks in advance.

This looks like problem with session resumption and compression in  
OpenSSL version you are using. Obvious workaround is to use

```
proxy_ssl_session_reuse off;

```

in nginx config, see [Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_ssl_session_reuse).

Alternatively you may try upgrading openssl or recompiling one you  
are using without zlib support.

Maxim D.

---

<div class="post-metadata">

**Author:** ![lima](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e5b9ba/32.png) [@lima](https://www.ruby-forum.com/u/lima)\
**Post date:** [May 23, 2012, 10:25am UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929/3 "2012-05-23T10:25:08Z")

</div>

Hello!

On Wed, May 23, 2012 at 03:03:33AM -0400, lima wrote:

> Thanks for the reply.
> 
> The first solution has solved the problem!! unfortunately we cannot make  
> proxy\_ssl\_session\_reuse off, as it may affect the performance. And the  
> second option given by you is also cannot be done as the system team has  
> some concern over it. The Openssl version we are using is the latest one  
> supported by the CentOS version we are using.
> 
> Is it possible to configure/compile nginx without zlib support?

This isn’t about nginx and zlib support, it’s about OpenSSL and  
zlib support.

The zlib support in the OpenSSL version you are using is known to  
have problems, and it can’t be switched off dynamically as the  
SSL\_OP\_NO\_COMPRESSION option appeared only in OpenSSL 1.0.0.

Another workaround you may try is to force SSLv2 between nginx and  
backend servers (by using appropriate settings on backends), it  
should eliminate compression as it’s not supported in SSLv2  
protocol.

You may also try compiling nginx statically with newer version of  
OpenSSL (or the same one, but without zlib support) by using  
./configure --with-openssl=…, it might help as well.

> Again, is the gzip module creating problem here? We tried with gzip on  
> and off but still it was giving the same problem.

No, gzip module is completely unrelated.

Maxim D.

---

<div class="post-metadata">

**Author:** ![lima](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e5b9ba/32.png) [@lima](https://www.ruby-forum.com/u/lima)\
**Post date:** [May 23, 2012, 11:01am UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929/4 "2012-05-23T11:01:17Z")

</div>

On Wed, May 23, 2012 at 03:03:33AM -0400, lima wrote:

> Again, is the gzip module creating problem here? We tried with gzip on  
> and off but still it was giving the same problem.

Try the attached patch.

---

<div class="post-metadata">

**Author:** ![lima](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e5b9ba/32.png) [@lima](https://www.ruby-forum.com/u/lima)\
**Post date:** [May 23, 2012, 9:04am UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929/5 "2012-05-23T09:04:21Z")

</div>

Thanks for the reply.

The first solution has solved the problem!! unfortunately we cannot make  
proxy\_ssl\_session\_reuse off, as it may affect the performance. And the  
second option given by you is also cannot be done as the system team has  
some concern over it. The Openssl version we are using is the latest one  
supported by the CentOS version we are using.

Is it possible to configure/compile nginx without zlib support?

Again, is the gzip module creating problem here? We tried with gzip on  
and off but still it was giving the same problem.

Thanks again.

Posted at Nginx Forum:

> **[Re: Bad Decompression error after default ssl\_session\_timeout](https://forum.nginx.org/read.php?2,226705,226745#msg-226745)**
>
> Hi, I have an LB setup with nginx for an ssl enabled site which load balance with 2 apache servers. All the servers are CentOS5.5\* and OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008. Also we are using the same SSL certificate on all the 3 servers. It does...

---

<div class="post-metadata">

**Author:** ![lima](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e5b9ba/32.png) [@lima](https://www.ruby-forum.com/u/lima)\
**Post date:** [May 23, 2012, 11:50am UTC](https://www.ruby-forum.com/t/bad-decompression-error-after-default-ssl-session-timeout/219929/6 "2012-05-23T11:50:43Z")

</div>

Hi Maxim,

That helped a lot!!. Thank you very much.  
It is working fine with SSLv2. I will see if I can upgrade the OpenSSL  
version and try with SSLv3.

Thanks again.

Posted at Nginx Forum:

> **[Re: Bad Decompression error after default ssl\_session\_timeout](https://forum.nginx.org/read.php?2,226705,226760#msg-226760)**
>
> Hi, I have an LB setup with nginx for an ssl enabled site which load balance with 2 apache servers. All the servers are CentOS5.5\* and OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008. Also we are using the same SSL certificate on all the 3 servers. It does...