ssl handshake failure with backend server

That's a bit unreadable I'd recommend using some wiki tags so the info formats better.

That being said, what is 192.168.111.58? The backend or the virtual IP?

If it's the backend, it would seem to me the backend isn't talking SSL or requires a client certificate. You can add -prexit to your openssl command to see if it wants a client cert.

If it's the virtual IP, then we'd have to know more about your client-ssl profile. You don't get to the server-ssl profile until after client-ssl was successful.

Looks like the server doesn't support any of the ciphers you are offering in your server SSL profile. What kind of server is it on the backend? Do you know what ciphers it supports? Have you tried using something more broad like DEFAULT or NATIVE for your cipher string to find out what it can negotiate?

Looks like the server doesn't support any of the ciphers you are offering in your server SSL profile. What kind of server is it on the backend? Do you know what ciphers it supports? Have you tried using something more broad like DEFAULT or NATIVE for your cipher string to find out what it can negotiate?

My client ssl profile:

• admin@(f5lab01-asm)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm profile client-ssl home.com ltm profile client-ssl home.com {

   

  alert-timeout 10

   

  allow-non-ssl disabled

   

  app-service none

   

  cache-size 262144

   

  cache-timeout 3600

   

  cert home.com.crt

   

  cert-key-chain {

   

  home {

   

  cert home.com.crt

   

  key home.com.key

   

  }

   

  }

   

  chain none

   

  ciphers DEFAULT

   

  defaults-from clientssl

   

  generic-alert enabled

   

  handshake-timeout 10

   

  inherit-certkeychain false

   

  key home.com.key

   

  max-renegotiations-per-minute 5

   

  mod-ssl-methods disabled

   

  mode enabled

   

  options { dont-insert-empty-fragments }

   

  passphrase none

   

  peer-no-renegotiate-timeout 10

   

  proxy-ssl disabled

   

  proxy-ssl-passthrough disabled

   

  renegotiate-max-record-delay indefinite

   

  renegotiate-period indefinite

   

  renegotiate-size indefinite

   

  renegotiation enabled

   

  secure-renegotiation require

   

  server-name none

   

  session-mirroring disabled

   

  session-ticket disabled

   

  sni-default false

   

  sni-require false

   

  ssl-sign-hash any

   

  strict-resume disabled

   

  unclean-shutdown enabled

   

  }

This is my last change on ssl server profile

admin@(f5lab01-asm)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm profile server-ssl back-end-servers ltm profile server-ssl back-end-servers { alert-timeout 10

app-service none

authenticate once

authenticate-depth 9

authenticate-name none

ca-file none

cache-size 262144

cache-timeout 3600

cert none

chain none

***ciphers SSLv3:SSLv3+RC4-SHA:SSLv2:RSA+RC4:RSA+AES:RSA+DES:RSA+3DES***

crl-file none

defaults-from serverssl

expire-cert-response-control drop

generic-alert enabled

handshake-timeout 10

key none

mod-ssl-methods disabled

mode enabled

options none

peer-cert-mode ignore

proxy-ssl disabled

proxy-ssl-passthrough disabled

renegotiate-period indefinite

renegotiate-size indefinite

renegotiation disabled

retain-certificate true

**secure-renegotiation request**

server-name none

session-mirroring disabled

session-ticket disabled

sni-default false

sni-require false

ssl-forward-proxy disabled

ssl-forward-proxy-bypass disabled

ssl-sign-hash any

strict-resume disabled

unclean-shutdown enabled

untrusted-cert-response-control drop

}

For what it's worth, the server is sending a FIN right after the client's ClientHello. That would never indicate that the server requires a client certificate as the CertificateRequest message is AFTER the server's ServerHello and Certificate messages. At most the reasons for the server not sending a ServerHello would be (in general order of precedence):

1. No support for the client's preferred protocol version or list of supported ciphers
2. A missing server name indicator (SNI) extension, if the server requires it
3. Some unknown or incorrect TLS extension