Environment: f5 ver 11.4.0 my Workstation: 12.232.44.42 Virtual Server: 12.232.44.36 Same Certificate for Server Profile And Client Profile. getting TCP RESET while accessing to HTTPS with the real URL. any ideas? CURL output: curl -v https://******.*****.com * About to connect() to ****.*****.com port 443 (0) * Trying 12.232.44.36... connected * Connected to ****.*****.com (12.232.44.36) port 443 (0) * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSLv3, TLS handshake, Client hello (1): * SSLv3, TLS handshake, Server hello (2): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS handshake, Server finished (14): * SSLv3, TLS handshake, Client key exchange (16): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * SSL connection using DES-CBC3-SHA * Server certificate: * subject: C=IL; ****ST=****; L=****; ****** *; O=******* Ltd; OU=T****; OU=Issued through *** *** Ltd *** Manager; OU=P****SL Wildcard; CN=*.****.com * start date: 20**-11-11 00:00:00 GMT * expire date: 2017-0*-** **:**:** GMT * subjectAltName: ****.****.com matched * issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Organization Validation Secure Server CA * SSL certificate verify ok. > GET / HTTP/1.1 > User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8y zlib/1.2.3 libidn/0.6.5 > Host: ****.*****.com > Accept: */* > * SSL read: error:00000000:lib(0):func(0):reason(0), errno 104 * Closing connection 0 SSL dump: New TCP connection 1: 12.232.44.42(55932) <-> 12.232.44.36(443) 1 1 0.0005 (0.0005) C>S Handshake ClientHello Version 3.3 resume [32]= 27 70 b7 dc 87 50 1a aa 37 e9 b5 38 c7 37 60 88 7b 8f 03 de fa 89 0e 84 f5 1e ea 68 a0 ba 25 2c cipher suites Unknown value 0xc02b Unknown value 0xc02f Unknown value 0xc02c Unknown value 0xc030 Unknown value 0xcca9 Unknown value 0xcca8 Unknown value 0xcc14 Unknown value 0xcc13 Unknown value 0xc009 Unknown value 0xc013 Unknown value 0xc00a Unknown value 0xc014 Unknown value 0x9c Unknown value 0x9d TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA compression methods NULL 1 2 0.0009 (0.0003) S>C Handshake ServerHello Version 3.3 session_id[32]= 27 70 b7 dc 87 50 1a aa 37 e9 b5 38 c7 37 60 88 7b 8f 03 de fa 89 0e 84 f5 1e ea 68 a0 ba 25 2c cipherSuite Unknown value 0xc014 compressionMethod NULL 1 3 0.0009 (0.0000) S>C ChangeCipherSpec 1 4 0.0009 (0.0000) S>C Handshake 1 5 0.0014 (0.0004) C>S ChangeCipherSpec 1 6 0.0014 (0.0000) C>S Handshake 1 7 0.0017 (0.0003) S>C application_data 1 8 0.0021 (0.0003) C>S application_data 1 0.0028 (0.0006) S>C TCP RST

Forum Discussion

Dvirus_297774

Altocumulus

Dec 08, 2016

TCP RST

Environment: f5 ver 11.4.0

my Workstation: 12.232.44.42

Virtual Server: 12.232.44.36

Same Certificate for Server Profile And Client Profile.

getting TCP RESET while accessing to HTTPS with the real URL.

any ideas?

CURL output:

curl -v https://******.*****.com
* About to connect() to ****.*****.com port 443 (0)
*   Trying 12.232.44.36... connected
* Connected to ****.*****.com (12.232.44.36) port 443 (0)
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using DES-CBC3-SHA
* Server certificate:
*        subject: C=IL; ****ST=****; L=****; ****** *; O=******* Ltd; OU=T****; OU=Issued through *** *** Ltd *** Manager; OU=P****SL Wildcard; CN=*.****.com
*        start date: 20**-11-11 00:00:00 GMT
*        expire date: 2017-0*-** **:**:** GMT
*        subjectAltName: ****.****.com matched
*        issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Organization Validation Secure Server CA
*        SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8y zlib/1.2.3 libidn/0.6.5
> Host: ****.*****.com
> Accept: */*
>
* SSL read: error:00000000:lib(0):func(0):reason(0), errno 104
* Closing connection 0

SSL dump:

New TCP connection 1: 12.232.44.42(55932) <-> 12.232.44.36(443)
1 1  0.0005 (0.0005)  C>S  Handshake
      ClientHello
        Version 3.3
        resume [32]=
          27 70 b7 dc 87 50 1a aa 37 e9 b5 38 c7 37 60 88
          7b 8f 03 de fa 89 0e 84 f5 1e ea 68 a0 ba 25 2c
        cipher suites
        Unknown value 0xc02b
        Unknown value 0xc02f
        Unknown value 0xc02c
        Unknown value 0xc030
        Unknown value 0xcca9
        Unknown value 0xcca8
        Unknown value 0xcc14
        Unknown value 0xcc13
        Unknown value 0xc009
        Unknown value 0xc013
        Unknown value 0xc00a
        Unknown value 0xc014
        Unknown value 0x9c
        Unknown value 0x9d
        TLS_RSA_WITH_AES_128_CBC_SHA
        TLS_RSA_WITH_AES_256_CBC_SHA
        TLS_RSA_WITH_3DES_EDE_CBC_SHA
        compression methods
                  NULL
1 2  0.0009 (0.0003)  S>C  Handshake
      ServerHello
        Version 3.3
        session_id[32]=
          27 70 b7 dc 87 50 1a aa 37 e9 b5 38 c7 37 60 88
          7b 8f 03 de fa 89 0e 84 f5 1e ea 68 a0 ba 25 2c
        cipherSuite         Unknown value 0xc014
        compressionMethod                   NULL
1 3  0.0009 (0.0000)  S>C  ChangeCipherSpec
1 4  0.0009 (0.0000)  S>C  Handshake
1 5  0.0014 (0.0004)  C>S  ChangeCipherSpec
1 6  0.0014 (0.0000)  C>S  Handshake
1 7  0.0017 (0.0003)  S>C  application_data
1 8  0.0021 (0.0003)  C>S  application_data
1    0.0028 (0.0006)  S>C  TCP RST

Solved,

Found on my iis server -> Event Viewer -> Event ID "36874"

An TLS 1.2 connection request was received from a remote client application,
but none of the cipher suites supported by the client application are supported by the server.
The SSL connection request has failed.

for now I disabled TLS 1.2 on SSL Server Profile and it's all good!

Thanks everyone!

Kai_Wilke

MVP

Dec 08, 2016

Hi Dvir,

it seems that the clienside is already working well for you, but the serverside then somehow fails...

You may attach the iRule below to your Virtual Server to see at which stage the communication is failing. In addition you may also increase the SSL log level to debug (see WebUI >> System ›› Logs : Configuration : Options )...

when SERVER_CONNECTED {
    log local0.debug "Connected to [IP::server_addr]"
}
when SERVERSSL_CLIENTHELLO_SEND {
    log local0.debug "Send SSL CLIENTHELLO to [IP::server_addr]"
}
when SERVERSSL_SERVERHELLO {
    log local0.debug "Received SSL SERVERHELLO from [IP::server_addr]"
}
when SERVERSSL_HANDSHAKE {
    log local0.debug "SSL Handshake complete with [IP::server_addr]"
}
when HTTP_REQUEST_SEND {
    log local0.debug "Forwarding HTTP request to [IP::server_addr]"
}

Cheers, Kai

Soda_Cup_148395
Nimbostratus
Dec 09, 2016
I would check each of these-

-certs on the client ssl profile -certs used for the server ssl with client authentication I see you have -certs on the server

one of these could be mismatched or the server not ready to receive requests
Stanislas_Piro2
Cumulonimbus
Dec 10, 2016
Hi,

Why are you configuring serverssl profile with certificate.

if you configure serverssl with certificate, the F5 will use this certificate to authenticate against the SSL server.

If you want only to enable HTTPS on server side, use the default serverssl profile
Dvirus_297774
Altocumulus
Dec 11, 2016
Solved,

Found on my iis server -> Event Viewer -> Event ID "36874"

An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

for now I disabled TLS 1.2 on SSL Server Profile and it's all good!

Thanks everyone!
- Kai_Wilke
  MVP
  Dec 14, 2016
  Hi Dvirus,
  
  sorry for my late response, I was somewhat busy these days. Glad you have found the issue on the serverside SSL negotiation in the meantime... ;-)
  
  Cheers, Kai