# Intermittent SSL Handshake Errors

**URL:** <https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027>\
**Category:** NGINX\
**Created:** [January 31, 2015, 7:06pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027 "2015-01-31T19:06:11Z")\
**Posts on this page:** 9\
**Page:** 2

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [April 18, 2015, 11:33pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/21 "2015-04-18T23:33:04Z")

</div>

Just an update: as of today, even Debian provides  
libssl1.0.0:1.0.1e-2+deb7u16 which still generates these error logs, so  
it  
looks like the only way is still to fallback to  
libssl1.0.0:1.0.1e-2+deb7u12.

Posted at Nginx Forum:

> **[Re: Intermittent SSL Handshake Errors](https://forum.nginx.org/read.php?2,256373,258186#msg-258186)**
>
> Hi, We are using round-robin DNS to distribute requests to three servers all running identically configured nginx. Connections then go upstream to HAProxy and then to our Rails app. About two weeks ago, users began to experience intermittent SSL...

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [July 12, 2015, 6:33pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/22 "2015-07-12T18:33:26Z")

</div>

I found myself with the same problem and found the cause (and obvious  
solution).

On my nginx server I run various website and they all have their own  
server  
{} config block in separate files under ‘sites-available’ folder.  
Some sites are on different IP’s and some are on the same IP.

Now the cause of the problem was because I’d had set 2 server blocks  
listening on the same IP on SSL for different server\_names like so:

server {  
listen 37.230.101.215:443 ssl spdy;  
server\_name [www.domain1.com](http://www.domain1.com) \*.domain1.com;

ssl on;  
ssl\_certificate /etc/ssl/cert.crt;  
ssl\_certificate\_key /etc/ssl/key.key;  
ssl\_session\_cache shared:SSL:10m;  
ssl\_session\_timeout 10m;

…etc  
}

and for another site the same:

server {  
listen 37.230.101.215:443 ssl spdy;  
server\_name [www.domain2.com](http://www.domain2.com) \*.domain2.com;

ssl on;  
ssl\_certificate /etc/ssl/cert.crt;  
ssl\_certificate\_key /etc/ssl/key.key;  
ssl\_session\_cache shared:SSL:10m;  
ssl\_session\_timeout 10m;

…etc  
}

When you do this it gives the exact same error as this thread is about…  
might be something to check.

Posted at Nginx Forum:

> **[Re: Intermittent SSL Handshake Errors](https://forum.nginx.org/read.php?2,256373,260227#msg-260227)**
>
> Hi, We are using round-robin DNS to distribute requests to three servers all running identically configured nginx. Connections then go upstream to HAProxy and then to our Rails app. About two weeks ago, users began to experience intermittent SSL...

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [July 12, 2015, 7:38pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/23 "2015-07-12T19:38:52Z")

</div>

Out of thin air, I suspect it is a certificate problem.  
You seem to have configured _the same_ certificate (and private key) for  
those 2 domains. Since certificates are generally tied to a single  
domain,  
that could explain errors.

## Another idea: have you checked nginx has been built with SNI support and you client also supports it? Problems with SNI would mean the default server certificate (since you did not define a default server for your IP address/port pair, nginx would pick up the first block containing a ‘listen’ directive configured for it) would be presented whatever domain you are trying to access, ending up with certificate/domain mismatch. See [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html).

_B. R._

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [July 15, 2015, 3:59am UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/24 "2015-07-15T03:59:27Z")

</div>

Here’s what we’ve learned so far:

The issue is related to a new security feature that blocks TLS Fallback,  
which is a client that connects with one version of TLS, then tries to  
downgrade the connection and connect with a lower TLS version… It was a  
feature made in light of the Poodle SSL vulnerability in order to keep  
SSL  
secure. The problem is that many networking libraries still exhibit this  
behavior of downgrading TLS versions on purpose, which OpenSSL then  
blocks  
the connection.

Specificially, the NSURLConnection class on iOS exhibits this behavior.  
NSURLSession, the latest iteration of this client, does not. The problem  
is,  
if you want to support iOS 6 still, you HAVE to use NSURLConnection. We  
decided to end support for iOS 6 because of this. NSURLConnection is  
also  
completely depracated in iOS 9, so if you want to support iOS 9, you’ll  
have  
to upgrade your client library anyway.

On Android, the same thing happened, but not as often and between  
different  
TLS versions. Switching to Square’s Retrofit client for SSL purposes has  
worked really well for us.

So, the real fix is to make sure you update your clients. If you’re on a  
Debian wheezy box, you can make your own openssl package with the latest  
version, but with TLS\_FALLBACK\_SCSV support removed by following the  
directions below. Note, this is not recommended from a security  
perspective,  
but if your environment is broken, you need to do what you need to do.  
As  
long as SSL v3 is disabled, there’s no big, active vulnerability in the  
wild  
that takes advantage of fallback at the moment.

Setup dquilt as shown on  
[https://www.debian.org/doc/manuals/maint-guide/modify.en.html](https://www.debian.org/doc/manuals/maint-guide/modify.en.html)

Building Package:  
apt-get update ; apt-get source libssl1.0.0  
cd openssl-1.0.1e  
dquilt pop Support-TLS\_FALLBACK\_SCSV  
dquilt delete Support-TLS\_FALLBACK\_SCSV  
dpkg-source --commit  
dpkg-buildpackage

The debian packages will be one directory back. Make sure to install the  
libssl packages you created, not just openssl, and nginx will need a  
restart  
to use the new library, not just a reload.

I hope this helps someone, we spent a good amount of time on this.

Posted at Nginx Forum:

> **[Re: Intermittent SSL Handshake Errors](https://forum.nginx.org/read.php?2,256373,260305#msg-260305)**
>
> Hi, We are using round-robin DNS to distribute requests to three servers all running identically configured nginx. Connections then go upstream to HAProxy and then to our Rails app. About two weeks ago, users began to experience intermittent SSL...

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [July 15, 2015, 6:09pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/25 "2015-07-15T18:09:59Z")

</div>

Hello!

On Tue, Jul 14, 2015 at 09:58:52PM -0400, tempspace wrote:

> Specificially, the NSURLConnection class on iOS exhibits this behavior.  
> So, the real fix is to make sure you update your clients. If you’re on a  
> Building Package:
> 
> I hope this helps someone, we spent a good amount of time on this.

Thanks for the info, appreciated.

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [January 16, 2016, 12:37am UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/26 "2016-01-16T00:37:20Z")

</div>

Yeah I removed the double blocks and it solved the problem…  
The ‘possible bug’ though is that the problem seems completely random..  
instead of giving error all the time sometimes it works and sometimes it  
doesn’t… Just refreshing the site a few times and it worked..

So it looks like Nginx just randomly picks the cert..

Also SNI is enabled I checked.

## B.R. Wrote:

> ## server certificate (since you did not define a default server for your IP address/port pair, nginx would pick up the first block containing a ‘listen’ directive configured for it) would be presented whatever domain you are trying to access, ending up with certificate/domain mismatch. See [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html).
> 
> _B. R._

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,256373,263987#msg-263987](https://forum.nginx.org/read.php?2,256373,263987#msg-263987)

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [January 11, 2016, 8:14pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/27 "2016-01-11T20:14:39Z")

</div>

I am facing the same issue on my Debian 7 Server. I downgraded to  
1.0.1e-2+deb7u12 version of libssl1.0.0 and restarted nginx but the  
issue is  
still occurring for me. I can still see the same logs.

I also tried following these instructions(installed the deb packages  
made by  
these instructions) but even these didn’t help:

apt-get update ; apt-get source libssl1.0.0

> cd openssl-1.0.1e  
> dquilt pop Support-TLS\_FALLBACK\_SCSV  
> dquilt delete Support-TLS\_FALLBACK\_SCSV  
> dpkg-source --commit  
> dpkg-buildpackage

Can anybody suggest as to what i can do to fix this?

After trying both methods, i restarted nginx by using

sudo service nginx restart

But i can still see the same error logs.

How can i be sure that nginx is picking up the updated libssl and  
openssl  
binaries? Is there any way to check if the SSL library which NGINX is  
using  
has support for TLS\_FALLBACK\_SCSV?

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,256373,263933#msg-263933](https://forum.nginx.org/read.php?2,256373,263933#msg-263933)

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [February 11, 2016, 7:27pm UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/28 "2016-02-11T19:27:11Z")

</div>

I am facing the same problem. I had one ssl certificate setup for the  
following domains:

[firstdomain.com](http://firstdomain.com)  
\*.firstdomain.com  
[a.firstdomain.com](http://a.firstdomain.com)  
[b.firstdomain.com](http://b.firstdomain.com)  
[a.seconddomain.com](http://a.seconddomain.com)  
[b.seconddomain.com](http://b.seconddomain.com)

When i read that it could be due to multiple different domains using the  
same ssl certificate, i removed the [seconddomain.com](http://seconddomain.com) server blocks from  
my  
nginx. So now i am left with:

[firstdomain.com](http://firstdomain.com)  
\*.firstdomain.com  
[a.firstdomain.com](http://a.firstdomain.com)  
[b.firstdomain.com](http://b.firstdomain.com)

The error frequency seems to have gone down but i still see some errors.  
How  
do you suggest i solve it?

I can try and merge [a.firstdomain.com](http://a.firstdomain.com) and [b.subdomain.com](http://b.subdomain.com) so that they  
can  
be accessed from the same server block \*.firstdomain.com

Then only 2 server blocks will be left:

[firstdomain.com](http://firstdomain.com)  
\*.firstdomain.com

Do you think i’ll still face the same issue after this? If yes, should i  
move [firstdomain.com](http://firstdomain.com) to a different server?

If no, how do you suggest i try to solve this?

It would be great if you can help me solve this. Thanks.

Posted at Nginx Forum:

> **[Re: Intermittent SSL Handshake Errors](https://forum.nginx.org/read.php?2,256373,264488#msg-264488)**
>
> Hi, We are using round-robin DNS to distribute requests to three servers all running identically configured nginx. Connections then go upstream to HAProxy and then to our Rails app. About two weeks ago, users began to experience intermittent SSL...

---

<div class="post-metadata">

**Author:** ![erubin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/82dd89/32.png) [@erubin](https://www.ruby-forum.com/u/erubin)\
**Post date:** [January 16, 2016, 12:42am UTC](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027/29 "2016-01-16T00:42:01Z")

</div>

do want to add the cert I was using was subdomain wildcard and the  
blocks  
where for different subdomains so that should not have been a problem  
with  
the cert… maybe its an access issue to the cert? (nginx can’t access it  
multiple times at the same moment or something)

Posted at Nginx Forum:

> **[Re: Intermittent SSL Handshake Errors](https://forum.nginx.org/read.php?2,256373,263988#msg-263988)**
>
> Hi, We are using round-robin DNS to distribute requests to three servers all running identically configured nginx. Connections then go upstream to HAProxy and then to our Rails app. About two weeks ago, users began to experience intermittent SSL...

[Previous page](https://www.ruby-forum.com/t/intermittent-ssl-handshake-errors/234027.md?page=1)