Forum Discussion

Qasim's avatar
Qasim
Icon for Cirrostratus rankCirrostratus
Aug 08, 2019

SSL Troubleshoot (fatal Description : handshake failure)

Hi,

 

I have a service that run in two DCs one primary and another secondary. the service is configured like the following:

 

Client --> tcp/443 LTM ----->tcp/80 backend.

 

however, the service has stopped working on the primary DC and this is the error I am seeing on wireshark:

339 5.076474 10.10.22.33 10.60.132.140 SSLv3 61 Alert (Level: Fatal, Description: Handshake Failure)

 

However, when I failover to the secondary site everything works and I don;t see the above error. I have triple checked everything on both LTMs in both DCs and everything matches 100%.

 

Can anyone please point me in the right direction?

 

Regards,

 

  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for Noctilucent rankNoctilucent
    Aug 08, 2019

    Hello Qasim

    It could be many things starting from release version and ending to certificate (and a lot of things more).

    I recommend you to connect using openssl and try to figure out the error message.

    openssl s_client -connect <virtual_server>:<port>

    Also in /var/log/ltm you could have more info about the error. You could also disable 'Generic Alert' in your SSL profile to get more info.

    There is a great guide for troubleshooting this issue here

    https://support.f5.com/csp/article/K15292

    KR,

    Dario.

    • Dario_Garrido's avatar
      Dario_Garrido
      Icon for Noctilucent rankNoctilucent
      Aug 08, 2019

      BTW, SSLv3 seems a very poor cipher suite...

       

      Maybe the cipher set is different in both DC.

  • Qasim's avatar
    Qasim
    Icon for Cirrostratus rankCirrostratus
    Aug 09, 2019

    Thanks Dario,

     

     

    Aug 8 18:27:10 LLB02-SEC warning tmm[17405]: 01260009:4: Connection error: ssl_hs_ciphprivdec:3622: crypto_req_process (80)

    Aug 8 18:27:10 LLB02-SEC crit tmm[17405]: 01010025:2: Device error: crypto codec No codec available to initialize request context.

     

    • Dario_Garrido's avatar
      Dario_Garrido
      Icon for Noctilucent rankNoctilucent
      Aug 09, 2019

      It seems any problem with the codec

      "Device error: crypto codec No codec available to initialize request context".

       

      I've never seen this kind of issue, so it seems a bug related with the release. I recommend you to open a TS case.

       

      BTW, have you disable "generic alert" option in your SSL profile?

       

      Also, it would be helpfull to decrypt the traffic to figure out the exact message you are receiving after the "ChangeCipherSpec" message.

      REF - https://support.f5.com/csp/article/K16700

      REF - https://support.f5.com/csp/article/K19310681

       

      KR,

      Dario.

  • Qasim's avatar
    Qasim
    Icon for Cirrostratus rankCirrostratus
    Aug 09, 2019

    Ok cheers Dario

     

    I have raised this with TS now.

     

    kind regards,