Forum Discussion
Ajit
Altostratus
AltostratusSSL handshake failure using serverssl (F5 and Citrix Netscaler)
Hello F5 Experts,
I am getting fatal ssl handshake failure(40) right after the server hello message from the Citrix Netscaler which sits and the vendor location. I can see in wireshark that the TLS protocol & ciphers between the F5 and Netscaler are matching so not sure what else it could be. The serverssl profile is failing and the party on the other side has Citrix netscaler. We have F5 LTM at our end.Also, the citrix netscaler presents a wildcard cert to us as part of SSL termination. Could that be a problem for the F5?
Below are few logs from the ssldump output:
New TCP connection 7: 10.104.41.138(56218) <-> 10.104.40.136(443)
7 1 1529673027.5089 (0.0001) C>SV3.1(121) Handshake
ClientHello
Version 3.3
random[32]=
46 f9 98 03 10 6c 14 84 4f 11 4e 81 f0 a0 92 dd
15 07 84 70 8c c4 94 c4 4d 2c ee 76 df d3 34 32
cipher suites
Unknown value 0xc02f
Unknown value 0xc030
Unknown value 0x9c
Unknown value 0x9d
Unknown value 0xc027
Unknown value 0xc028
Unknown value 0xc013
Unknown value 0xc014
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
Unknown value 0xc012
TLS_RSA_WITH_3DES_EDE_CBC_SHA
Unknown value 0xff
compression methods
NULL
3 2 1529673027.5333 (0.0299) S>CV3.3(74) Handshake
ServerHello
Version 3.3
random[32]=
5b 2c f5 46 8d 5d 9a 7e 02 10 6e 1c 90 3f d6 02
cb 4c be 17 cb 7c 0c 1f 55 c8 77 fc bd 85 21 88
session_id[32]=
73 0d 48 68 8d da 73 e5 77 07 3a dc 47 a2 51 40
88 32 a2 3e d6 5c 3a 6b 4e dc c8 2c 28 d2 3c 27
cipherSuite TLS_RSA_WITH_AES_256_CBC_SHA
compressionMethod NULL
3 3 1529673027.5333 (0.0000) C>SV3.3(2) Alert
level fatal
value handshake_failure
2 1529673027.5333 (0.0306) S>C TCP RST
3 1529673027.5334 (0.0000) C>S TCP RST
Please advise. Any help with this would be really appreciated.
Thank you!
can you change Secure Negotiation to Request and test
AjitHello Anesh,
Your answer is correct. After making the requested changes the issue got resolved. Thanks for your help! 🙂
I want to highlight few points with which it was confirmed that this is an HSTS issue:
1) Warning message in the LB logs as below:
18:40:24 LBNAME warning tmm1[23850]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborted: 10.104.40.136:4432) Openssl command which clearly indicates the problem: `New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 1024 bit -->> Secure Renegotiation IS NOT supported <<-- Compression: NONE Expansion: NONE Also, the same problem has been highlighted in K13860 Regards, Ajit
David_MCirrostratus
which openssl command are you referring to?
The basic openssl s_client ?
- Ajit
Hello Anesh,
Your answer is correct. After making the requested changes the issue got resolved. Thanks for your help! 🙂
I want to highlight few points with which it was confirmed that this is an HSTS issue:
1) Warning message in the LB logs as below:
18:40:24 LBNAME warning tmm1[23850]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborted: 10.104.40.136:4432) Openssl command which clearly indicates the problem:
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 1024 bit -->> Secure Renegotiation IS NOT supported <<-- Compression: NONE Expansion: NONEAlso, the same problem has been highlighted in K13860
Regards,
Ajit
- Anesh
Can you mark my answer as accepted answer.
- Ajit
Hello Anesh,
Please can you post your answer in the answer section? In the comment section I cannot mark it as an answer.
Regards,
Ajit
- Anesh
In your ServerSSL profile, can you try updating Secure Renegotiation from Require Strict to Request