Forcing a particular SSL protocol for an nginx proxying server

Question

I am developing an application against a remote https web service. While developing I need to proxy requests from my local development server (running nginx on ubuntu) to the remote https web server. Here is the relevant nginx config:

server {
    server_name project.dev;
    listen 443;
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    location / {

        proxy_pass      https://remote.server.com;
        proxy_set_header Host remote.server.com;
        proxy_redirect off;
    }
}

The problem is that the remote HTTPS server can only accept connections over SSLv3 as can be seen from the following openssl calls.

Not working:

$ openssl s_client -connect remote.server.com:443                 
CONNECTED(00000003)
139849073899168:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 226 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Working:

$ openssl s_client -connect remote.server.com:443 -ssl3
CONNECTED(00000003)
<snip>
---
SSL handshake has read 1562 bytes and written 359 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 1024 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : RC4-SHA
<snip>

With the current setup my nginx proxy gives a 502 Bad Gateway when I connect to it in a browser. Enabling debug in the error log I can see the message: [info] 1451#0: *16 peer closed connection in SSL handshake while SSL handshaking to upstream.

I tried adding ssl_protocols SSLv3; to the nginx configuration but that didn't help.

Does anyone know how I can set this up to work correctly?

Edit - additional requested info added:

Running on Ubuntu 12.04 with OpenSSL version:

$ openssl version
OpenSSL 1.0.1 14 Mar 2012

The solution

The solution, as provided by @Christopher Perrin below is to downgrade openssl to 1.0.0. Here is the commands that successfully did this for me (on ubuntu 12.04 running on AMD64):

wget http://launchpadlibrarian.net/81976289/openssl_1.0.0e-2ubuntu4_amd64.deb
sudo dpkg -i openssl_1.0.0e-2ubuntu4_amd64.deb
wget http://launchpadlibrarian.net/81976290/libssl1.0.0_1.0.0e-2ubuntu4_amd64.deb
sudo dpkg -i libssl1.0.0_1.0.0e-2ubuntu4_amd64.deb

It seems like he Problem is somwhere between your SSL client or the server. Normally the SSL version should automatically be negotiated — Christopher Perrin, Oct 10 '12 at 11:28
Thanks for the answer - additional information added above... — vitch, Oct 10 '12 at 12:45

score 4 · Answer 1 · edited Nov 05 '12 at 20:05

This is due to the fact that when you try to Nginx compiled with Openssl version 1.0.1 in which they have introduced TLSv1.1 and TLSv1.2 whenever Nginx is trying to connect to backend server it will reset connect with peer closed connection in SSL handshake (54: Connection reset by peer) while SSL handshaking to upstream in Nginx Debug Logs which means backend does not have TLSv1.1 and TLSv1.2 support.

If Load Balancer is being used then you/client need to upgrade their Load Balancer Frimware.

score 1 · Accepted Answer · edited Apr 13 '17 at 12:14

1

The possible solution to your Problem is decribed here

You have to downgrade to OpenSSL 1.0.0 in the Nginx system because of a bug.

edited Apr 13 '17 at 12:14

Community

1

answered Oct 10 '12 at 13:00

Christopher Perrin

4,811
19
33

Thanks - this sounds like the problem and possible workaround/ solution. I'll figure out how to get OpenSSL downgraded and then will update this answer with my experience... – vitch Oct 10 '12 at 15:03
I managed to downgrade openssl with the following commands: `wget http://launchpadlibrarian.net/81976289/openssl_1.0.0e-2ubuntu4_amd64.deb` `sudo dpkg -i openssl_1.0.0e-2ubuntu4_amd64.deb` Now I can connect from the `openssl` commandline but get the same error from nginx :( Any further ideas? – vitch Oct 11 '12 at 16:48
have you also downgraded the libs of openssl? Probably thay are different packages. – Christopher Perrin Oct 11 '12 at 17:39
Yes - I did just before leaving the office and it worked! Thanks so much for your help - I'll update the question tomorrow morning with the full set of commands that worked for me :) – vitch Oct 11 '12 at 21:11
Glad I could help – Christopher Perrin Oct 11 '12 at 22:56

score 1 · Answer 3 · answered Oct 19 '17 at 14:42

I ran into a similar issue reverse proxying Nginx to IIS 6 on Windows 2003 after a recent update which upgraded the openssl libraries on the Nginx box. What worked for me is to change the Nginx directive:

ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;

to

proxy_ssl_protocols   TLSv1;

score 0 · Answer 4 · answered Oct 10 '12 at 12:49

0

Try to force a ssl version being announced by the server

ssl_prefer_server_ciphers on;
ssl_protocols SSLv3 TLSv1;
# Set the ciphers to use. You may have to fix formatting. 
ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:\
            EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:\
            AES128-SHA:RC4-SHA:RC4-MD5;

answered Oct 10 '12 at 12:49

Mike

22,310
7
56
79

Thanks for the answer :) You got my hopes up but unfortunately it doesn't seem to work :( I get the same error even with the ssl_ciphers set to `RC4-SHA` (which is what the server connects with in reply to the `openssl s_client -connect remote.server.com:443 -ssl3` call). Any other ideas? – vitch Oct 10 '12 at 14:56

Forcing a particular SSL protocol for an nginx proxying server

The solution

4 Answers4

Linked