Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am developing an application against a remote https web service. While developing I need to proxy requests from my local development server (running nginx on ubuntu) to the remote https web server. Here is the relevant nginx config:

server {
    server_name project.dev;
    listen 443;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    location / {

        proxy_pass      https://remote.server.com;
        proxy_set_header Host remote.server.com;
        proxy_redirect off;
    }
}

The problem is that the remote HTTPS server can only accept connections over SSLv3 as can be seen from the following openssl calls.

Not working:

$ openssl s_client -connect remote.server.com:443                 
CONNECTED(00000003)
139849073899168:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 226 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Working:

$ openssl s_client -connect remote.server.com:443 -ssl3
CONNECTED(00000003)
<snip>
---
SSL handshake has read 1562 bytes and written 359 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 1024 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : RC4-SHA
<snip>

With the current setup my nginx proxy gives a 502 Bad Gateway when I connect to it in a browser. Enabling debug in the error log I can see the message: [info] 1451#0: *16 peer closed connection in SSL handshake while SSL handshaking to upstream.

I tried adding ssl_protocols SSLv3; to the nginx configuration but that didn't help.

Does anyone know how I can set this up to work correctly?

Edit - additional requested info added:

Running on Ubuntu 12.04 with OpenSSL version:

$ openssl version
OpenSSL 1.0.1 14 Mar 2012

The solution

The solution, as provided by @Christopher Perrin below is to downgrade openssl to 1.0.0. Here is the commands that successfully did this for me (on ubuntu 12.04 running on AMD64):

wget http://launchpadlibrarian.net/81976289/openssl_1.0.0e-2ubuntu4_amd64.deb
sudo dpkg -i openssl_1.0.0e-2ubuntu4_amd64.deb
wget http://launchpadlibrarian.net/81976290/libssl1.0.0_1.0.0e-2ubuntu4_amd64.deb
sudo dpkg -i libssl1.0.0_1.0.0e-2ubuntu4_amd64.deb
share|improve this question
    
It seems like he Problem is somwhere between your SSL client or the server. Normally the SSL version should automatically be negotiated –  Christopher Perrin Oct 10 '12 at 11:28
    
Could you please add your OpenSSL version and OS Version? –  Christopher Perrin Oct 10 '12 at 11:34
    
Thanks for the answer - additional information added above... –  vitch Oct 10 '12 at 12:45
    
What is the status of this given Heartbleed? –  philwinkle Jul 17 at 6:17

3 Answers 3

up vote 1 down vote accepted

The possible solution to your Problem is decribed here

You have to downgrade to OpenSSL 1.0.0 in the Nginx system because of a bug.

share|improve this answer
    
Thanks - this sounds like the problem and possible workaround/ solution. I'll figure out how to get OpenSSL downgraded and then will update this answer with my experience... –  vitch Oct 10 '12 at 15:03
    
I managed to downgrade openssl with the following commands: wget http://launchpadlibrarian.net/81976289/openssl_1.0.0e-2ubuntu4_amd64.deb sudo dpkg -i openssl_1.0.0e-2ubuntu4_amd64.deb Now I can connect from the openssl commandline but get the same error from nginx :( Any further ideas? –  vitch Oct 11 '12 at 16:48
    
have you also downgraded the libs of openssl? Probably thay are different packages. –  Christopher Perrin Oct 11 '12 at 17:39
    
Yes - I did just before leaving the office and it worked! Thanks so much for your help - I'll update the question tomorrow morning with the full set of commands that worked for me :) –  vitch Oct 11 '12 at 21:11
    
Glad I could help –  Christopher Perrin Oct 11 '12 at 22:56

Try to force a ssl version being announced by the server

ssl_prefer_server_ciphers on;
ssl_protocols SSLv3 TLSv1;
# Set the ciphers to use. You may have to fix formatting. 
ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:\
            EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:\
            AES128-SHA:RC4-SHA:RC4-MD5;
share|improve this answer
    
Thanks for the answer :) You got my hopes up but unfortunately it doesn't seem to work :( I get the same error even with the ssl_ciphers set to RC4-SHA (which is what the server connects with in reply to the openssl s_client -connect remote.server.com:443 -ssl3 call). Any other ideas? –  vitch Oct 10 '12 at 14:56

This is due to the fact that when you try to Nginx compiled with Openssl version 1.0.1 in which they have introduced TLSv1.1 and TLSv1.2 whenever Nginx is trying to connect to backend server it will reset connect with peer closed connection in SSL handshake (54: Connection reset by peer) while SSL handshaking to upstream in Nginx Debug Logs which means backend does not have TLSv1.1 and TLSv1.2 support.

If Load Balancer is being used then you/client need to upgrade their Load Balancer Frimware.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.