Forum Discussion

Mihkel_Roots_15's avatar
Mihkel_Roots_15
Icon for Nimbostratus rankNimbostratus
Mar 18, 2015

Connection error: ssl_select_suite:5745: TLS_FALLBACK_SCSV with a lower protocol (86)

I cant understand how do I get rid of this message. This error causes https webpage errors. Not all the time but about 30% of all connections.

 

After upgrading SSL cert to ECC cert and ECDSA key, then problems begun.

 

F5 debug log:

 

Connection error: ssl_select_suite:5745: TLS_FALLBACK_SCSV with a lower protocol (86)

 

Browser error ( latest Chrome and Opera ):

 

A secure connection cannot be established because this site uses an unsupported protocol.

 

ssl options

 

No SSLv2 No SSLv3

 

Ciphers are ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-CBC-SHA:ECDHE-RSA-AES256-CBC-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA:!RC4

 

ECC cert and ecdsa key are described in ssl-client, also RSA key and cert

 

8 Replies

  • SynACk_128568's avatar
    SynACk_128568
    Icon for Cirrostratus rankCirrostratus
    Mar 18, 2015

    Hi Mihkel ,

     

    Can you please see which cipher suites are sent by client to the F5 when the issue happens and check in wireshark . above ciphers are of F5 client ssl or client ?

     

    Thanks

     

    • Mihkel_Roots_15's avatar
      Mihkel_Roots_15
      Icon for Nimbostratus rankNimbostratus
      Mar 19, 2015
      Hi, Client sends Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Ciphers above are F5 client ssl ciphers. Thanks for your time :)
  • Mihkel_Roots_15's avatar
    Mihkel_Roots_15
    Icon for Nimbostratus rankNimbostratus
    Mar 19, 2015

    Hi,

     

    Client sends Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)

     

    Ciphers above are F5 client ssl ciphers.

     

    Thanks for your time :)

     

  • SynACk_128568's avatar
    SynACk_128568
    Icon for Cirrostratus rankCirrostratus
    Mar 19, 2015

    is the client also sending tls fallback cipher ? Which ssl version are enabled on client and servre ?

     

    • Mihkel_Roots_15's avatar
      Mihkel_Roots_15
      Icon for Nimbostratus rankNimbostratus
      Mar 20, 2015
      no its not sending fallback cipher. Server enabled: TLSv1, TLSv1.1, TLSv1.2 Client: Same as server
  • Mihkel_Roots_15's avatar
    Mihkel_Roots_15
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2015

    no its not sending fallback cipher.

     

    Server enabled: TLSv1, TLSv1.1, TLSv1.2 Client: Same as server

     

  • Mihkel_Roots_15's avatar
    Mihkel_Roots_15
    Icon for Nimbostratus rankNimbostratus
    Mar 31, 2015

    I just tested and with RSA cert and RSA key, all works fine. Seems F5 has TLS problem with elliptic curve certs and ECC ciphers

     

    • SynACk_128568's avatar
      SynACk_128568
      Icon for Cirrostratus rankCirrostratus
      Apr 01, 2015
      Good to know issue is resolved . but not sure if F5 is to be blamed Mikel .. if you have support F5 , you can confirm with F5 . Regards