Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a proxy server through Apache with modssl, which we're using to proxy POSTs from mobile devices to another internal server. This works successfully for most clients, but requests from a specific phone model (Nokia 2690) are showing a bizarre handshake failure.

It looks as though OpenSSL is either requesting (or attempting to read an unsolicited) client certificate from the phone (which is especially bizarre because j2me's kssl implementation doesn't support client certs). I've disabled client certificates with the SSLVerifyClient none directive in both the virtual host conf and the modssl conf. The trace from error.log on debug level is (details redacted):

[client] Connection to child 0 established (server
[info] Seeding PRNG with 656 bytes of entropy
[debug] ssl_engine_kernel.c(1866): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: before/accept initialization
[debug] ssl_engine_io.c(1882): OpenSSL: read 11/11 bytes from BIO#7fe3fbaf17a0 [mem: 7fe3fbaf90d0] (BIO dump follows)
[debug] ssl_engine_io.c(1815): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1860): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1882): OpenSSL: read 49/49 bytes from BIO#7fe3fbaf17a0 [mem: 7fe3fbaf90db] (BIO dump follows)
[debug] ssl_engine_io.c(1815): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1860): +-------------------------------------------------------------------------+
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 read client hello A
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write server hello A
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write certificate A
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write server done A
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 flush data
[debug] ssl_engine_io.c(1882): OpenSSL: read 5/5 bytes from BIO#7fe3fbaf17a0 [mem: 7fe3fbaf90d0] (BIO dump follows)
[debug] ssl_engine_io.c(1815): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1860): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1882): OpenSSL: read 2/2 bytes from BIO#7fe3fbaf17a0 [mem: 7fe3fbaf90d5] (BIO dump follows)
[debug] ssl_engine_io.c(1815): +-------------------------------------------------------------------------+
[debug] ssl_engine_io.c(1860): +-------------------------------------------------------------------------+
[debug] ssl_engine_kernel.c(1879): OpenSSL: Read: SSLv3 read client certificate A
[debug] ssl_engine_kernel.c(1898): OpenSSL: Exit: failed in SSLv3 read client certificate A
[client] SSL library error 1 in handshake (server
[info] SSL Library Error: 336151568 error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
[client] Connection closed to child 0 with abortive shutdown (server

I've tried enabling all ciphers and all protocols temporarily with modssl, neither of which seemed to be the issue. The phone should be using RSA_RC4_128_MD5 and SSLv3, all of which are available.

Am I missing something more fundamental about what's failing here? It seemed like the certificate request might have been part of a renegotiation failure. I tried enabling SSLInsecureRenegotiation On on the virtual host, in case it was an issue of the phone's SSL not supporting the new protocol, but to no avail.

Currently running: Apache/2.2.16 (Ubuntu) mod_ssl/2.2.16 OpenSSL/0.9.8o Apache proxy_html/3.0.1

share|improve this question

I had the same problem, and it turns that the problem is actually in the error message - its confusing. If you look at the exact protocol bytes read by the server (which you removed - here is the relevant part from my log):

ssl_engine_io.c(1854): | 0000: 15 03 01 00 02

ssl_engine_io.c(1854): | 0000: 02 28

The 0x15 refers to ContentType 21, which is an alert message. "03 01" is the version and "00 02" is the length of the actually message.

"02 28" means fatal error 40, and refers to a handshake_failure, which simply means that the server didn't offer anything that the client could use. In other words, the Nokia don't have the required root certs to recognize your ssl cert.

When this error occurs, the server protocol state machine is waiting to read the optional client certificate. So the "SSLv3 read client certificate A" is simply the server reporting what state it was in when it received the alert message from the client.

Just slightly confusing.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.