F5 Big-Ip upgraded to 11.1, "Open SSL error - error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure" and many other errors

We had an issue with https monitors not including the host name in the GET and failing as a result. The requirement, or lack thereof, of a host name appears to differ between HTTP 1.1 and HTTP 1.0.

 

 

You can try forcing HTTP 1.0 in your monitor and see if the server is willing to respond to that. If that does not work I would try incorporating a host name into the monitor. We actually ended up making a different monitor for every https server in our config. Here is an example.

 

 

 

ltm monitor https custom_example_ssl {

 

cipherlist DEFAULT:+SHA:+3DES:+kEDH

 

compatibility enabled

 

defaults-from https

 

description "Custom monitor pointing to f5healthmonitor virtual on IIS"

 

destination *:*

 

interval 5

 

recv "HTTP/1.1 200 OK"

 

send "GET /f5healthmonitor/index.htm HTTP/1.1\\r\\nHost: www.example.com\\r\\nConnection: Close\\r\\n\\r\\n"

 

time-until-up 0

 

timeout 16

 

}