I'm using haproxy 1.8.17 and openssl 1.1.1a from Debian testing to serve TLS 1.2 connections with client authentication.

In wireshark I observe the usual TLS messages:

  • client->server: Client Hello
  • server->client: Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
  • client->server: Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message

Now HAProxy answers with: Alert (Level: Fatal, Description: Decrypt Error)

So my question is: what can cause this type of error?

  • RFC5246: "A handshake cryptographic operation failed, including being unable to correctly verify a signature or validate a Finished message. This message is always fatal." Jan 22, 2019 at 10:33

1 Answer 1


In this case the cause of the error is very simple: I've used the wrong CA cert in the haproxy config.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .