SSL handshaking fails

nginx reverse-proxy sslv3
b.mazgarov picture b.mazgarov · Feb 17, 2018 · Viewed 12.2k times · Source

Strange situation: there is an android app. Before it was working directly to apache2. Recently I've tried to use nginx as a reverse proxy. Application stopped working. Debug on nginx log shows "SSL_do_handshake() failed (SSL: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown:SSL alert number 46) while SSL handshaking". Then switched back to apache2, switched on debugging, but on apache2 application connects using TLS not SSLv3. Is there anybody met such situation? Why android app trying to connect with nginx using SSLv2 (which is deprecated) but with apache2 with TLS? Thanks for thoughts in advance.

Answer

b.mazgarov picture b.mazgarov · Feb 18, 2018

I found the answer. Actually, when I use nginx as a reverse-proxy I used SSL certificates in nginx from apache as it is. I found, that in nginx there is a different approach in SSL certificate aplication. The link below helped me:
https://medium.com/@mrkdsgn/steps-to-install-a-go-daddy-ssl-certificate-on-nginx-on-ubuntu-14-04-ff942b9fd7ff
Hope the answer will help you not to make mistake like me.

Related questions

From inside of a Docker container, how do I connect to the localhost of the machine?

So I have a Nginx running inside a docker container, I have a mysql running on localhost, I want to connect to the MySql from within my Nginx. The MySql is running on localhost and not exposing a port to …

Read More
Nginx reverse proxy causing 504 Gateway Timeout

I am using Nginx as a reverse proxy that takes requests then does a proxy_pass to get the actual web application from the upstream server running on port 8001. If I go to mywebsite.com or do a wget, I …

Read More
How to serve all existing static files directly with NGINX, but proxy the rest to a backend server.

location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; if (-f $request_filename) { access_log off; expires 30d; break; } if (!-f $request_filename) { proxy_pass http://127.0.0.1:8080; # backend server …

Read More