Forum Discussion

Dvirus_297774's avatar
Dvirus_297774
Icon for Altocumulus rankAltocumulus
Dec 08, 2016
Solved

TCP RST

Environment: f5 ver 11.4.0

my Workstation: 12.232.44.42

Virtual Server: 12.232.44.36

Same Certificate for Server Profile And Client Profile.

getting TCP RESET while accessing to HTTPS with the real URL.

any ideas?

CURL output:

curl -v https://******.*****.com
* About to connect() to ****.*****.com port 443 (0)
*   Trying 12.232.44.36... connected
* Connected to ****.*****.com (12.232.44.36) port 443 (0)
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using DES-CBC3-SHA
* Server certificate:
*        subject: C=IL; ****ST=****; L=****; ****** *; O=******* Ltd; OU=T****; OU=Issued through *** *** Ltd *** Manager; OU=P****SL Wildcard; CN=*.****.com
*        start date: 20**-11-11 00:00:00 GMT
*        expire date: 2017-0*-** **:**:** GMT
*        subjectAltName: ****.****.com matched
*        issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Organization Validation Secure Server CA
*        SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8y zlib/1.2.3 libidn/0.6.5
> Host: ****.*****.com
> Accept: */*
>
* SSL read: error:00000000:lib(0):func(0):reason(0), errno 104
* Closing connection 0

SSL dump:

New TCP connection 1: 12.232.44.42(55932) <-> 12.232.44.36(443)
1 1  0.0005 (0.0005)  C>S  Handshake
      ClientHello
        Version 3.3
        resume [32]=
          27 70 b7 dc 87 50 1a aa 37 e9 b5 38 c7 37 60 88
          7b 8f 03 de fa 89 0e 84 f5 1e ea 68 a0 ba 25 2c
        cipher suites
        Unknown value 0xc02b
        Unknown value 0xc02f
        Unknown value 0xc02c
        Unknown value 0xc030
        Unknown value 0xcca9
        Unknown value 0xcca8
        Unknown value 0xcc14
        Unknown value 0xcc13
        Unknown value 0xc009
        Unknown value 0xc013
        Unknown value 0xc00a
        Unknown value 0xc014
        Unknown value 0x9c
        Unknown value 0x9d
        TLS_RSA_WITH_AES_128_CBC_SHA
        TLS_RSA_WITH_AES_256_CBC_SHA
        TLS_RSA_WITH_3DES_EDE_CBC_SHA
        compression methods
                  NULL
1 2  0.0009 (0.0003)  S>C  Handshake
      ServerHello
        Version 3.3
        session_id[32]=
          27 70 b7 dc 87 50 1a aa 37 e9 b5 38 c7 37 60 88
          7b 8f 03 de fa 89 0e 84 f5 1e ea 68 a0 ba 25 2c
        cipherSuite         Unknown value 0xc014
        compressionMethod                   NULL
1 3  0.0009 (0.0000)  S>C  ChangeCipherSpec
1 4  0.0009 (0.0000)  S>C  Handshake
1 5  0.0014 (0.0004)  C>S  ChangeCipherSpec
1 6  0.0014 (0.0000)  C>S  Handshake
1 7  0.0017 (0.0003)  S>C  application_data
1 8  0.0021 (0.0003)  C>S  application_data
1    0.0028 (0.0006)  S>C  TCP RST
application delivery
LTM
security
  • Dvirus_297774's avatar
    Dvirus_297774
    Dec 11, 2016

    Solved,

    Found on my iis server -> Event Viewer -> Event ID "36874"

    An TLS 1.2 connection request was received from a remote client application,
but none of the cipher suites supported by the client application are supported by the server.
The SSL connection request has failed.

    for now I disabled TLS 1.2 on SSL Server Profile and it's all good!

    Thanks everyone!

5 Replies

Sort By
  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Dec 08, 2016

    Hi Dvir,

    it seems that the clienside is already working well for you, but the serverside then somehow fails...

    You may attach the iRule below to your Virtual Server to see at which stage the communication is failing. In addition you may also increase the SSL log level to debug (see WebUI >> System ›› Logs : Configuration : Options )...

    when SERVER_CONNECTED {
    log local0.debug "Connected to [IP::server_addr]"
}
when SERVERSSL_CLIENTHELLO_SEND {
    log local0.debug "Send SSL CLIENTHELLO to [IP::server_addr]"
}
when SERVERSSL_SERVERHELLO {
    log local0.debug "Received SSL SERVERHELLO from [IP::server_addr]"
}
when SERVERSSL_HANDSHAKE {
    log local0.debug "SSL Handshake complete with [IP::server_addr]"
}
when HTTP_REQUEST_SEND {
    log local0.debug "Forwarding HTTP request to [IP::server_addr]"
}

    Cheers, Kai

  • Soda_Cup_148395's avatar
    Soda_Cup_148395
    Icon for Nimbostratus rankNimbostratus
    Dec 09, 2016

    I would check each of these-

     

    -certs on the client ssl profile -certs used for the server ssl with client authentication I see you have -certs on the server

     

    one of these could be mismatched or the server not ready to receive requests

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Dec 10, 2016

    Hi,

     

    Why are you configuring serverssl profile with certificate.

     

    if you configure serverssl with certificate, the F5 will use this certificate to authenticate against the SSL server.

     

    If you want only to enable HTTPS on server side, use the default serverssl profile

     

  • Dvirus_297774's avatar
    Dvirus_297774
    Icon for Altocumulus rankAltocumulus
    Dec 11, 2016

    Solved,

    Found on my iis server -> Event Viewer -> Event ID "36874"

    An TLS 1.2 connection request was received from a remote client application,
but none of the cipher suites supported by the client application are supported by the server.
The SSL connection request has failed.

    for now I disabled TLS 1.2 on SSL Server Profile and it's all good!

    Thanks everyone!

    • Kai_Wilke's avatar
      Kai_Wilke
      Icon for MVP rankMVP
      Dec 14, 2016

      Hi Dvirus,

       

      sorry for my late response, I was somewhat busy these days. Glad you have found the issue on the serverside SSL negotiation in the meantime... ;-)

       

      Cheers, Kai