# Ssl handshake fail when proxy between two tomcat with mutual authentication

**URL:** <https://www.ruby-forum.com/t/ssl-handshake-fail-when-proxy-between-two-tomcat-with-mutual-authentication/235915>\
**Category:** NGINX\
**Created:** [July 24, 2013, 2:15am UTC](https://www.ruby-forum.com/t/ssl-handshake-fail-when-proxy-between-two-tomcat-with-mutual-authentication/235915 "2013-07-24T02:15:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alcina](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@alcina](https://www.ruby-forum.com/u/alcina)\
**Post date:** [July 24, 2013, 2:15am UTC](https://www.ruby-forum.com/t/ssl-handshake-fail-when-proxy-between-two-tomcat-with-mutual-authentication/235915/1 "2013-07-24T02:15:26Z")

</div>

Hi,

I’ve got a problem when setting up nginx as load balancer between two  
tomcats with mutual authentication.

The system is like: Tomcat1 \<–https-\> Nginx \<–https–\> Tomcat2.

Before adding nginx, the mutual authentication between tomcat1 and  
tomcat2  
works fine, using cert/key and keystore/truststore. Now with nginx,  
links  
between tomcat1 and nginx is OK, but the SSL handshake between nginx and  
tomcat2 not work. Wonder how to assign the keystore/truststore stuff  
that  
needed when communicating with tomcat2, can’t find related directive in  
nginx ssl module configuration.

Any idea for this? Thanks!

My nginx configuration is like:

```
upstream backend {
    server 10.1.1.1:8443;
    server 10.1.1.2:8443;
}

server {
    listen 8443 ssl;
    server_name localhost;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_client_certificate /etc/nginx/ssl/ca.crt;
    ssl_ciphers ALL:!ADH:!kEDH:!SSLv2:!EXPORT40:!EXP:!LOW;
    ssl_verify_client on;
    ssl_verify_depth 2;

    location / {
        proxy_pass https://backend;
    }
}

```

And tomcat2 configuration is like:

And the error log is:  
2013/07/23 20:25:11 [error] 18116#0: \*1 SSL\_do\_handshake() failed (SSL:  
error:14094410:SSL routines:SSL3\_READ\_BYTES:sslv3 alert handshake  
failure:SSL alert number 40) while SSL handshaking to upstream, client

* * *

Posted at Nginx Forum:

> **[ssl handshake fail when proxy between two tomcat with mutual authentication](https://forum.nginx.org/read.php?2,241171,241171#msg-241171)**
>
> Hi, I've got a problem when setting up nginx as load balancer between two tomcats with mutual authentication. The system is like: Tomcat1 \<--https-\> Nginx \<--https--\> Tomcat2. Before adding nginx, the mutual authentication between tomcat1...

---

<div class="post-metadata">

**Author:** ![drinsnow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/53a042/32.png) [@drinsnow](https://www.ruby-forum.com/u/drinsnow)\
**Post date:** [December 30, 2013, 1:53am UTC](https://www.ruby-forum.com/t/ssl-handshake-fail-when-proxy-between-two-tomcat-with-mutual-authentication/235915/2 "2013-12-30T01:53:29Z")

</div>

Hi Dirnsnow,

Have you find the solution for your problem of mutual auth between Nginx  
and  
Tomcat2? I meet the same error as yours when I am using Nginx as a  
reverse  
proxy and trying to mutual talk my backend server through mutual SSL.

Thank you,  
flash008

Posted at Nginx Forum:

> **[Re: ssl handshake fail when proxy between two tomcat with mutual authentication](https://forum.nginx.org/read.php?2,241171,245912#msg-245912)**
>
> Hi, I've got a problem when setting up nginx as load balancer between two tomcats with mutual authentication. The system is like: Tomcat1 \<--https-\> Nginx \<--https--\> Tomcat2. Before adding nginx, the mutual authentication between tomcat1...