Random SSL Handshake failure

Question

I'm seeing some strange SSL handshake failures on the client side. We are having custom web js application that is accessed only by browsers with older Webkit (like found in Epiphany). All requests coming from client are made from the same browser (version and type).

Here are the symptoms:

a.) client browser displays SSL Handshake failure:

• If webpage is reloaded, error stays
• If browser session is killed and new session loaded, error goes away

b.) No SSL errors are found in nginx error, syslog or openssl log

c.) In tcp dump I'm seeing some strange occasional SSL Handshake errors:

• List item Bad certificate status response
• No Certificate
• Internal Error

d.) we are using Let's encrypt SSL certificates

e.) nginx.conf:

• ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE

• ssl_prefer_server_ciphers on;

• nginx serves as proxy that redirects all http traffic to https

• sites-enabled:

server {

    listen 80;

    server_name srv_name;
    return 301 https://$host$request_uri;  

}

server {

    listen 443;
    server_name srv_name;


    proxy_connect_timeout 600;
    proxy_send_timeout 600;
    proxy_read_timeout 600;
    send_timeout 600;

    ssl on;
    ssl_certificate fullchain.pem_path;
    ssl_certificate_key privkey.pem_path;
    ssl_session_timeout 5m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;

    location /robots.txt {
            alias /opt/robots.txt;
    }

    location /.well-known/ {
            alias /usr/share/nginx/html/.well-known/;
    }

    location / {
            proxy_redirect off;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $http_host;
            proxy_pass http://localhost:8000/;
            break;
    }

}

f.) Basic flow:

• client browser opens http url and gets 301 redirect to https
• js application makes periodic ajax calls (I suspect those calls also randomly fail due to SSL handshake failure since HTTP response code equals 0)
• if ajax call returns http response code 0, page is reloaded (location.reload()), usually resulting in SSL handshake failure message in client browser.

g.) Things started to happen after the migration to new servers (from Ubuntu 14.04 lts (openssl 1.0.1f 6 Jan 2014) to Ubuntu 16.04 lts (1.0.2g 1 Mar 2016) Application and client browser version stayed the same.

Do you have any ideas where to look next? Why is this not happening always when client opens the url, but very sporadically.