Forum Discussion

LouisL-3_235765's avatar
LouisL-3_235765
Icon for Nimbostratus rankNimbostratus
Nov 26, 2015

SSL Termiation with load balancer occassionally causing SSL handshake exception

We are trying to achieve SSL termination using the LTM. The incoming connection from the router is using SSL (TLSv1.2) with client authentication to a virtual server with just the client SSL profile. This is load balanced using the default round robin type to two physical servers on the port 8080 using HTTP. Our issue is that occasionally we receive a Handshake exception (PKIX path building failed) and looking at the log (/var/log/ltm) it is between the router and the virtual server. This only happens when we send multiple messages in quick succession. We assume this is because of some timeout setting and have found and shortened the TCP profile timeout settings, this has reduced the time before we see a TCP FIN message. All attempted connections after this FIN message seem to establish the SSL connection correctly. If more than one connection is made before the FIN, that's when we sometimes get the SSL error.

Looking at the wireshark output, we can see each SSL connection tries to establish a new connection (i.e. client hello, server hello followed by the certificate message) even if another connection occurs a few seconds after the first (before the timeout expires). I would expect that the second connection would attempt to re-establish the previously negotiated SSL connection using the SSL session ID.

Below is a wireshark excerpt of the SSL messages. with the first connection being successful, and straight after, a certificate Unknown error. x.x.x.x is our router IP and is always the same, and 192.168.30.190 is the IP of our virtual Server.

718 96.389112000   x.x.x.x        192.168.30.190        TLSv1.2  211    Client Hello [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
720 96.391312000   192.168.30.190        x.x.x.x        TLSv1.2  4734   Server Hello, Certificate, Server Key Exchange, Server Hello Done [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
725 96.399544000   x.x.x.x        192.168.30.190        TLSv1.2  226    Client Key Exchange [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
727 96.403243000   x.x.x.x        192.168.30.190        TLSv1.2  93     Change Cipher Spec [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
729 96.403633000   x.x.x.x        192.168.30.190        TLSv1.2  132    Hello Request, Hello Request [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
731 96.403825000   192.168.30.190        x.x.x.x        TLSv1.2  93     Change Cipher Spec [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
732 96.403909000   192.168.30.190        x.x.x.x        TLSv1.2  132    New Session Ticket, Hello Request [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
734 96.405814000   x.x.x.x        192.168.30.190        TLSv1.2  663    Application Data [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
736 96.408694000   192.168.30.190        x.x.x.x        TLSv1.2  1564   Application Data [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
737 96.408704000   192.168.30.190        x.x.x.x        TLSv1.2  1564   Application Data [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
738 96.408709000   192.168.30.190        x.x.x.x        TLSv1.2  1564   Application Data [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
739 96.408805000   192.168.30.190        x.x.x.x        TLSv1.2  1172   Application Data [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
752 97.726426000   x.x.x.x        192.168.30.190        TLSv1.2  211    Client Hello [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
754 97.731289000   192.168.30.190        x.x.x.x        TLSv1.2  4734   Server Hello, Certificate, Server Key Exchange, Server Hello Done [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
759 97.739897000   x.x.x.x        192.168.30.190        TLSv1.2  94     Alert (Level: Fatal, Description: Certificate Unknown) [ETHERNET FRAME CHECK SEQUENCE INCORRECT]

Can anybody offer any guidance on what may be causing this issue? Or ask us to check for specific configuration settings that may be causing this issue.

Many Thanks

4 Replies

  • First, your subsequent connections will not try to resume the SSL session unless the client initiates as resumption by sending the session ID in the client Hello stating that it wants to resume the session. As for your error. Your client is the one terminating the handshake because of "Certificate Unknown". That is generally because of a chain issue. Ensure you are sending the proper chain certs to the client and then check that your client trusts the root of the chain you are sending.

     

    • LouisL-3_235765's avatar
      LouisL-3_235765
      Icon for Nimbostratus rankNimbostratus
      Thanks for the information regarding the SSL session.The chain certs are correct and the client trusts the root of that chain, which is why it will work most of the time, it only gives us this error when the requests are sent in quick succession which is why this problem has baffled us.
  • First, your subsequent connections will not try to resume the SSL session unless the client initiates as resumption by sending the session ID in the client Hello stating that it wants to resume the session. As for your error. Your client is the one terminating the handshake because of "Certificate Unknown". That is generally because of a chain issue. Ensure you are sending the proper chain certs to the client and then check that your client trusts the root of the chain you are sending.

     

    • LouisL-3_235765's avatar
      LouisL-3_235765
      Icon for Nimbostratus rankNimbostratus
      Thanks for the information regarding the SSL session.The chain certs are correct and the client trusts the root of that chain, which is why it will work most of the time, it only gives us this error when the requests are sent in quick succession which is why this problem has baffled us.