Forum Discussion

james_lee_31100's avatar
james_lee_31100
Icon for Nimbostratus rankNimbostratus
Nov 20, 2014

ssl handshake issue

Hi, All:

 

When I debug ssl issue, I saw following errors, I saw f5 has a doc. for the error code, but I could not find it..

 

What cause "unsupported version (40)", and what cause SSL handshake failed..

 

ltm code is 11.5.1 HF4

 

Thanks

 

Nov 19 19:30:39 slot1/lb-1 info tmm2[14084]: 01260013:6: SSL Handshake failed for TCP x.x.x.x:39113 -> 10.0.215.76:443 Nov 19 19:30:39 slot1/lb1 debug tmm3[14084]: 01260009:7: Connection error: ssl_hs_rxhello:5771: unsupported version (40) Nov 19 19:30:39 slot1/lb-1 info tmm3[14084]: 01260013:6: SSL Handshake failed for TCP x.x.x.x:51044 -> 10.0.215.76:443 Nov 19 19:30:39 slot1/lb-1 debug tmm2[14084]: 01260009:7: Connection error: ssl_hs_rxhello:5771: unsupported version (40)

 

application delivery
LTM

4 Replies

Sort By
  • Skye_85590's avatar
    Skye_85590
    Icon for Nimbostratus rankNimbostratus
    Nov 25, 2014

    You probably did something like disabling SSLv3 then a client tried to do an ssl3 handshake:

     

    This is actually the default behavior for the default ('DEFAULT') cipher ordering under 11.6.0 HF1 where I tested. I was using this command against a virtual server from the standby unit, forcing ssl3: openssl s_client -connect 172.24.76.79:443 -ssl3

     

    SSL in debug does not give much detail but it is evident in captures:

     

    Nov 24 19:50:19 drkraken debug tmm1[11366]: 01260009:7: Connection error: ssl_hs_rxhello:6147: unsupported version (40) Nov 24 19:50:19 drkraken info tmm1[11366]: 01260013:6: SSL Handshake failed for TCP 172.24.76.70:44545 -> 172.24.76.79:443

     

    Capture shows the sslv3 handshake attempt and subsequent (error 40).

     

    52014-11-24 19:53:36.519200172.24.76.7044195172.24.76.79443SSLv3304IN s1/tmm3 : Client Hello

     

    62014-11-24 19:53:36.519233172.24.76.79443172.24.76.7044195SSLv3173OUT s1/tmm3 : Level: Fatal, Description: Handshake Failure)

     

    Logically, I was able to get a successful handshake by enabling ssl3 explicitly on the client-ssl profile in use.

     

    Cheers!