I'm using haproxy 1.8.17 and openssl 1.1.1a from Debian testing to serve TLS 1.2 connections with client authentication.

In wireshark I observe the usual TLS messages:

  • client->server: Client Hello
  • server->client: Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
  • client->server: Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message

Now HAProxy answers with: Alert (Level: Fatal, Description: Decrypt Error)

So my question is: what can cause this type of error?

  • RFC5246: "A handshake cryptographic operation failed, including being unable to correctly verify a signature or validate a Finished message. This message is always fatal." Jan 22, 2019 at 10:33

1 Answer 1


In this case the cause of the error is very simple: I've used the wrong CA cert in the haproxy config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.