# SSL handshake failed with mutual TLS **URL:** \ **Category:** NGINX\ **Created:** [June 18, 2016, 10:30am UTC](https://www.ruby-forum.com/t/ssl-handshake-failed-with-mutual-tls/244807 "2016-06-18T10:30:52Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [June 18, 2016, 10:30am UTC](https://www.ruby-forum.com/t/ssl-handshake-failed-with-mutual-tls/244807/1 "2016-06-18T10:30:52Z")
Hello everyone. I’m setting up an internal web server that will accept requests from another systems (mostly enterprise-ish something) authenticated with client certificates. We’ve successfully configured interaction with two of these systems (all with mutual TLS), and when pointed another one to this server we’ve got next message in the error.log (log level for error log is set to debug): 2016/06/16 18:07:55 [info] 21742#0: \*179610 SSL\_do\_handshake() failed (SSL: error:14094412:SSL routines:SSL3\_READ\_BYTES:sslv3 alert bad certificate:SSL alert number 42) while SSL handshaking, client: 10.117.252.168, server: 0.0.0.0:8443 What can cause this message? How to debug it? Our setup is: Red Hat Enterprise Linux 7.1, Nginx 1.8.0 compiled from sources and run from unprivileged user, internet not available, root or sudo access not available too. Requests from other systems handled well. SSL configuration in nginx.conf as follows: ``` ssl_certificate /home/strela/ssl/strela.crt; ssl_certificate_key /home/strela/ssl/strela.key; ssl_client_certificate /home/strela/ssl/client-ca.crt; // Both ``` root and intermediate certs which signed client certs are included in this file ssl\_verify\_client on; ssl\_verify\_depth 2; ssl\_session\_cache shared:SSL:10m; ssl\_session\_timeout 10m; Thank you in advance, please ask for any additional info if required. With best regards, Andrey Novikov. ---
**Author:** ![Andrey\_Novikov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/bb73d2/32.png) [@Andrey\_Novikov](https://www.ruby-forum.com/u/Andrey_Novikov)\ **Post date:** [June 19, 2016, 11:10am UTC](https://www.ruby-forum.com/t/ssl-handshake-failed-with-mutual-tls/244807/2 "2016-06-19T11:10:00Z")
On Sat, Jun 18, 2016 at 11:29:49AM +0300, Andrey Novikov wrote: Hi there, > What can cause this message? How to debug it? > I think that this message (can|does) mean that the far side did not like > something about your certificate. If that is the case - are there any logs on the thing connecting to nginx about what it thinks happened in the TLS negotiation? Cheers, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Andrey\_Novikov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/bb73d2/32.png) [@Andrey\_Novikov](https://www.ruby-forum.com/u/Andrey_Novikov)\ **Post date:** [June 22, 2016, 1:24am UTC](https://www.ruby-forum.com/t/ssl-handshake-failed-with-mutual-tls/244807/3 "2016-06-22T01:24:20Z")
On 06/21/2016 03:59 AM, CJ Ess wrote: > Check that you have both the certificate and any intermediate > certificates in your pem file - you can skip the top-most CA > certificates as those are generally included in your browser’s CA > store - but the intermediates are not. > > I believe Nginx wants certs ordered from bottom-most (your cert) to > top-most (ca’s cert) - it used to be picky about that I haven’t > retried the ordering in a long while. It used to be your site cert at the top of the file. Don’t know whether this is still true, but I always do it! I recommend using the Qualys site ( [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/) ) to check and fine tune your SSL setup. They keep very current on all the vulns too, which is just sooo helpful. Steve – Steve H. BSc(Hons) MIITP > **[Linux & Admin Support Services | "Services provided by people who are proud...](https://www.greengecko.co.nz/)** > > Offers linux support services, systems and database administration, consultancy and the full development lifecycle for open source - based solutions Linkedin: [Steve Holdoway - Robotron New Zealand Limited | LinkedIn](http://www.linkedin.com/in/steveholdoway) Skype: sholdowa ---
**Author:** ![Andrey\_Novikov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/bb73d2/32.png) [@Andrey\_Novikov](https://www.ruby-forum.com/u/Andrey_Novikov)\ **Post date:** [June 20, 2016, 5:59pm UTC](https://www.ruby-forum.com/t/ssl-handshake-failed-with-mutual-tls/244807/4 "2016-06-20T17:59:28Z")
Check that you have both the certificate and any intermediate certificates in your pem file - you can skip the top-most CA certificates as those are generally included in your browser’s CA store - but the intermediates are not. I believe Nginx wants certs ordered from bottom-most (your cert) to top-most (ca’s cert) - it used to be picky about that I haven’t retried the ordering in a long while. ---
**Author:** ![Andrey\_Novikov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/bb73d2/32.png) [@Andrey\_Novikov](https://www.ruby-forum.com/u/Andrey_Novikov)\ **Post date:** [June 22, 2016, 9:31pm UTC](https://www.ruby-forum.com/t/ssl-handshake-failed-with-mutual-tls/244807/5 "2016-06-22T21:31:48Z")
Thank everyone for advices. I have server certificate (first) and Intermediate CA certificate (second) in bundle file specified in `ssl_certificate` directive. I have Intermediate CA certificate (first) and Root CA certificate (second) in bundle file specified in `ssl_client_certificate`. Both server and client certificate are issued by this intermediate CA certificate, command ``` openssl verify -verbose -CAfile ca.bundle.crt client.crt ``` returns ``` client.crt: OK ``` I can successfully connect to my server with curl (using server’s certificate itself as client cert) and browser. One system can access it with own client certificate (issued by the same intermediate), and problematic one can’t. I will ask for problematic client’s logs, not sure that it can help. Unfortunately my Nginx is located in private network and neither accessible from Internet nor have access to Internet. So I can’t use Qualys SSL Test. Any tests I can do with preinstalled in RHEL 7 curl and openssl?