5

I am developing an application against a remote https web service. While developing I need to proxy requests from my local development server (running nginx on ubuntu) to the remote https web server. Here is the relevant nginx config:

server {
    server_name project.dev;
    listen 443;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    location / {

        proxy_pass      https://remote.server.com;
        proxy_set_header Host remote.server.com;
        proxy_redirect off;
    }
}

The problem is that the remote HTTPS server can only accept connections over SSLv3 as can be seen from the following openssl calls.

Not working:

$ openssl s_client -connect remote.server.com:443                 
CONNECTED(00000003)
139849073899168:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 226 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Working:

$ openssl s_client -connect remote.server.com:443 -ssl3
CONNECTED(00000003)
<snip>
---
SSL handshake has read 1562 bytes and written 359 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 1024 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : RC4-SHA
<snip>

With the current setup my nginx proxy gives a 502 Bad Gateway when I connect to it in a browser. Enabling debug in the error log I can see the message: [info] 1451#0: *16 peer closed connection in SSL handshake while SSL handshaking to upstream.

I tried adding ssl_protocols SSLv3; to the nginx configuration but that didn't help.

Does anyone know how I can set this up to work correctly?

Edit - additional requested info added:

Running on Ubuntu 12.04 with OpenSSL version:

$ openssl version
OpenSSL 1.0.1 14 Mar 2012

The solution

The solution, as provided by @Christopher Perrin below is to downgrade openssl to 1.0.0. Here is the commands that successfully did this for me (on ubuntu 12.04 running on AMD64):

wget http://launchpadlibrarian.net/81976289/openssl_1.0.0e-2ubuntu4_amd64.deb
sudo dpkg -i openssl_1.0.0e-2ubuntu4_amd64.deb
wget http://launchpadlibrarian.net/81976290/libssl1.0.0_1.0.0e-2ubuntu4_amd64.deb
sudo dpkg -i libssl1.0.0_1.0.0e-2ubuntu4_amd64.deb
4
  • It seems like he Problem is somwhere between your SSL client or the server. Normally the SSL version should automatically be negotiated Oct 10, 2012 at 11:28
  • Could you please add your OpenSSL version and OS Version? Oct 10, 2012 at 11:34
  • Thanks for the answer - additional information added above...
    – vitch
    Oct 10, 2012 at 12:45
  • What is the status of this given Heartbleed?
    – philwinkle
    Jul 17, 2014 at 6:17

4 Answers 4

1

The possible solution to your Problem is decribed here

You have to downgrade to OpenSSL 1.0.0 in the Nginx system because of a bug.

5
  • Thanks - this sounds like the problem and possible workaround/ solution. I'll figure out how to get OpenSSL downgraded and then will update this answer with my experience...
    – vitch
    Oct 10, 2012 at 15:03
  • I managed to downgrade openssl with the following commands: wget http://launchpadlibrarian.net/81976289/openssl_1.0.0e-2ubuntu4_amd64.deb sudo dpkg -i openssl_1.0.0e-2ubuntu4_amd64.deb Now I can connect from the openssl commandline but get the same error from nginx :( Any further ideas?
    – vitch
    Oct 11, 2012 at 16:48
  • have you also downgraded the libs of openssl? Probably thay are different packages. Oct 11, 2012 at 17:39
  • Yes - I did just before leaving the office and it worked! Thanks so much for your help - I'll update the question tomorrow morning with the full set of commands that worked for me :)
    – vitch
    Oct 11, 2012 at 21:11
  • Glad I could help Oct 11, 2012 at 22:56
4

This is due to the fact that when you try to Nginx compiled with Openssl version 1.0.1 in which they have introduced TLSv1.1 and TLSv1.2 whenever Nginx is trying to connect to backend server it will reset connect with peer closed connection in SSL handshake (54: Connection reset by peer) while SSL handshaking to upstream in Nginx Debug Logs which means backend does not have TLSv1.1 and TLSv1.2 support.

If Load Balancer is being used then you/client need to upgrade their Load Balancer Frimware.

1

I ran into a similar issue reverse proxying Nginx to IIS 6 on Windows 2003 after a recent update which upgraded the openssl libraries on the Nginx box. What worked for me is to change the Nginx directive:

ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;

to

proxy_ssl_protocols   TLSv1;
0

Try to force a ssl version being announced by the server

ssl_prefer_server_ciphers on;
ssl_protocols SSLv3 TLSv1;
# Set the ciphers to use. You may have to fix formatting. 
ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:\
            EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:\
            AES128-SHA:RC4-SHA:RC4-MD5;
1
  • Thanks for the answer :) You got my hopes up but unfortunately it doesn't seem to work :( I get the same error even with the ssl_ciphers set to RC4-SHA (which is what the server connects with in reply to the openssl s_client -connect remote.server.com:443 -ssl3 call). Any other ideas?
    – vitch
    Oct 10, 2012 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .