# Intermittent "504 SSL\_do\_handshake() failed" **URL:** \ **Category:** NGINX\ **Created:** [October 24, 2010, 8:24pm UTC](https://www.ruby-forum.com/t/intermittent-504-ssl-do-handshake-failed/198006 "2010-10-24T20:24:58Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\ **Post date:** [October 24, 2010, 8:24pm UTC](https://www.ruby-forum.com/t/intermittent-504-ssl-do-handshake-failed/198006/1 "2010-10-24T20:24:58Z")
I seem to be having a problem with the secure reverse proxy. I have a “Synology Disk Station” that hosts Apache virtual servers with one being an administration web panel, and the other “[https://192.168.2.2/photo](https://192.168.2.2/photo)” being a photo/blogging site. I have googled around and looked at the NGINX forum and have found no solution to this problem or as to what is causing it. When I first launch nginx everything seems to work fine as expected, but after X amount of time testing (clearing client cache and using other browsers) I start intermittently getting “502 Bad Gateway” errors from Nginx. Both Nginx and Synology use a self-signed certificate. I have done a wireshark packet dump from Nginx and decrypted the packets via the server’s private key, and the only thing I noticed was 302 Not modified headers and the SSL Alerts with Key renegotiation. My network setup can be described as bellow: 192.168.2.2 [Synology (Apache)] ↔ 192.168.2.151 [Nginx] ↔ External [Client] My router is setup to serve only HTTPS 443 connections from my LAN to external. Versions: nginx version: nginx/0.7.65 on Ubuntu 10.04.1 LTS (lucid) Server version: Apache/2.2.16 (Unix) [Nginx Config] server { listen 443; ssl on; server\_name [home.fractalengine.com](http://home.fractalengine.com); ``` ##LOG ``` access\_log /var/log/nginx/localhost.access.log; ``` ##SSL Params ssl_certificate ssl/storage.in.crt; ssl_certificate_key ssl/storage.key; keepalive_timeout 60; ssl_verify_client off; ssl_session_cache off; location / { proxy_pass https://192.168.2.2; proxy_next_upstream error timeout invalid_header ``` http\_500 http\_502 http\_503; proxy\_set\_header Host $host; proxy\_set\_header X-Real-IP $remote\_addr; proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for; proxy\_set\_header X-Forwarded-Proto https; proxy\_redirect off; proxy\_cache\_use\_stale error timeout invalid\_header updating http\_500 http\_502 http\_503 http\_504; } ``` location /doc { root /usr/share; autoindex on; allow 127.0.0.1; deny all; } location /images { root /usr/share; autoindex on; } ``` [NGINX ERROR Log] 2010/10/22 17:23:24 [error] 5206#0: \*501 SSL\_do\_handshake() failed (SSL: error:1408C095:SSL routines:SSL3\_GET\_FINISHED:digest check failed) while SSL handshaking to upstream, client: 69.xx.xxx.x, server: [home.myDomain.com](http://home.myDomain.com), request: “GET /blog/modules/friend\_link.js HTTP/1.1”, upstream: “[https://192.168.2.2:443/blog/modules/friend\_link.js](https://192.168.2.2:443/blog/modules/friend_link.js)”, host: “[home.myDomain.com](http://home.myDomain.com)”, referrer: “[https://home.myDomain.com/blog/admin\_index.php](https://home.myDomain.com/blog/admin_index.php)” 2010/10/22 17:23:24 [error] 5206#0: \*506 SSL\_do\_handshake() failed (SSL: error:1408C095:SSL routines:SSL3\_GET\_FINISHED:digest check failed) while SSL handshaking to upstream, client: 69.xx.xxx.x, server: [home.myDomain.com](http://home.myDomain.com), request: “GET /blog/modules/label\_cloud.js HTTP/1.1”, upstream: “[https://192.168.2.2:443/blog/modules/label\_cloud.js](https://192.168.2.2:443/blog/modules/label_cloud.js)”, host: “[home.myDomain.com](http://home.myDomain.com)”, referrer: “[https://home.myDomain.com/blog/admin\_index.php](https://home.myDomain.com/blog/admin_index.php)” 2010/10/22 17:23:24 [error] 5206#0: \*504 SSL\_do\_handshake() failed (SSL: error:1408C095:SSL routines:SSL3\_GET\_FINISHED:digest check failed) while SSL handshaking to upstream, client: 69.xx.xxx.x, server: [home.myDomain.com](http://home.myDomain.com), request: “GET /blog/modules/statistical\_data.js HTTP/1.1”, upstream: “[https://192.168.2.2:443/blog/modules/statistical\_data.js](https://192.168.2.2:443/blog/modules/statistical_data.js)”, host: “[home.myDomain.com](http://home.myDomain.com)”, referrer: “[https://home.myDomain.com/blog/admin\_index.php](https://home.myDomain.com/blog/admin_index.php)” 2010/10/22 17:23:24 [error] 5206#0: \*507 SSL\_do\_handshake() failed (SSL: error:1408C095:SSL routines:SSL3\_GET\_FINISHED:digest check failed) while SSL handshaking to upstream, client: 69.xx.xxx.x, server: [home.myDomain.com](http://home.myDomain.com), request: “GET /blog/modules/recent\_article.js HTTP/1.1”, upstream: “[https://192.168.2.2:443/blog/modules/recent\_article.js](https://192.168.2.2:443/blog/modules/recent_article.js)”, host: “[home.myDomain.com](http://home.myDomain.com)”, referrer: “[https://home.myDomain.com/blog/admin\_index.php](https://home.myDomain.com/blog/admin_index.php)” Again the weird thing is it stops working after X amount of time testing. I’m starting to think it has something to do with the connection timeout from Nginx to Apache?? Or maybe something with the Cache? Any help would be greatly appreciated! Thanks! Posted at Nginx Forum: > **[Intermittent "504 SSL\_do\_handshake() failed"](https://forum.nginx.org/read.php?2,144108,144108#msg-144108)** > > I seem to be having a problem with the secure reverse proxy. I have a "Synology Disk Station" that hosts Apache virtual servers with one being an administration web panel, and the other "https://192.168.2.2/photo" being a... ---
**Author:** ![terminal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c89c15/32.png) [@terminal](https://www.ruby-forum.com/u/terminal)\ **Post date:** [October 24, 2010, 8:31pm UTC](https://www.ruby-forum.com/t/intermittent-504-ssl-do-handshake-failed/198006/2 "2010-10-24T20:31:52Z")
On Sun, Oct 24, 2010 at 02:23:52PM -0400, terminal wrote: > wireshark packet dump from Nginx and decrypted the packets via the > Versions: > access\_log /var/log/nginx/localhost.access.log; > proxy\_next\_upstream error timeout invalid\_header > > ``` > } > > ``` > > 2010/10/22 17:23:24 [error] 5206#0: \*506 SSL\_do\_handshake() failed (SSL: > HTTP/1.1", upstream: > “[https://home.myDomain.com/blog/admin\_index.php](https://home.myDomain.com/blog/admin_index.php)” > > Again the weird thing is it stops working after X amount of time > testing. I’m starting to think it has something to do with the > connection timeout from Nginx to Apache?? Or maybe something with the > Cache? Try proxy\_ssl\_session\_reuse off; – Igor S. > **[Igor Sysoev](http://sysoev.ru/en/)** ---
**Author:** ![terminal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c89c15/32.png) [@terminal](https://www.ruby-forum.com/u/terminal)\ **Post date:** [October 24, 2010, 9:05pm UTC](https://www.ruby-forum.com/t/intermittent-504-ssl-do-handshake-failed/198006/3 "2010-10-24T21:05:50Z")
Wow, that seems to have worked… I didn’t think it would be that simple of a solution. I will keep testing to make sure. I guess the problem was reusing the SSL sessions on the backend? Thanks again for your help, and quick response! Posted at Nginx Forum: > **[Re: Intermittent "504 SSL\_do\_handshake() failed"](https://forum.nginx.org/read.php?2,144108,144120#msg-144120)** > > I seem to be having a problem with the secure reverse proxy. I have a "Synology Disk Station" that hosts Apache virtual servers with one being an administration web panel, and the other "https://192.168.2.2/photo" being a... ---
**Author:** ![terminal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c89c15/32.png) [@terminal](https://www.ruby-forum.com/u/terminal)\ **Post date:** [February 8, 2012, 7:46am UTC](https://www.ruby-forum.com/t/intermittent-504-ssl-do-handshake-failed/198006/4 "2012-02-08T07:46:30Z")
A similar problem occurred in my case. Following is the ssl server configuration. At first I used AJP. But after I could not find a corresponding directive to proxy\_ssl\_session\_reuse, I changed to proxy. upstream loadbalancer { server 127.0.0.1:8080; ``` keepalive 100; ``` } server { listen 443 default ssl; ssl on; ``` ...... location / { #access_log off; #ajp_pass loadbalancer; proxy_pass http://loadbalancer; proxy_ssl_session_reuse off; } ``` } Here’s the error log: 2012/02/08 15:03:49 [info] 13273#0: \*1 SSL\_do\_handshake() failed (SSL: error:14094416:SSL routines:SSL3\_READ\_BYTES:sslv3 alert certificate unknown) while SSL handshaking, Any help would be greatly appreciated! Thanks in advance! Posted at Nginx Forum: > **[Re: Intermittent "504 SSL\_do\_handshake() failed"](https://forum.nginx.org/read.php?2,144108,222098#msg-222098)** > > I seem to be having a problem with the secure reverse proxy. I have a "Synology Disk Station" that hosts Apache virtual servers with one being an administration web panel, and the other "https://192.168.2.2/photo" being a...