0

We have a few Windows 2012 boxes running IIS 8 behind an AWS ELB. On a recent reboot, we lost the ability to hit those servers, via web browser, when connecting through the ELB. If we address the boxes directly, it works fine. At first we thought this was an ELB issue, but Amazon has not confirmed any problems on their end.

The connection from the browser is SSL which terminates at the ELB, but due to legacy application constraints, the ELB establishes a second SSL connection to the EC2 instance running IIS. If we modify the ELB to use TCP, vs. HTTPS we lose X-Forwarded-For header, but we get the connection from the ELB to the Web Server. This was enough to get us operational again, but not ideal.

For testing, we spun up a second Test ELB and configured it just like the original. We added the Web Server to both ELBs. If we hit the server through the first (modified -- using TCP vs. HTTPS and no X-F-F) one, it works. If we hit the server through the 2nd (Not in production, but how we want it configured ultimately) it fails again. We also spun up a virgin IIS box running 2012 and installed our certificate. When we remove our troubled box from behind the 2nd ELB and put in the virgin IIS box, it actually works (no idea why). It's a fairly laborious process to build up a functional web server, so if at all possible I'd just like to get the old one back online.

Qualys SSL Lab scans of the both the troubled box and the new (working) IIS box yields almost identical results: SSL v2 and v3 disabled TLS 1, 1.1 and 1.2 enabled

Amazon suggested we Wireshark it to determine the issue. I've attached the screenshots below.

The one that works: https://i.stack.imgur.com/JeG73.png (need 10 rep to put image inline--sorry)

The one the's broke: https://i.stack.imgur.com/6e37V.png

I'm not really sure how to interpret this, but it appears that the SSL connection is never negotiated in the broken case.

Any ideas?

Thanks very much in advance!

1 Answer 1

0

It turns out this was an issue with a recent Microsoft Patch (KB 2992611). We rolled back the patch and everything is working as expected. Please see article here for additional info:

http://www.zdnet.com/article/microsoft-warns-of-problems-with-schannel-security-update/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .