Forum Discussion

Ørjan's avatar
Ørjan
Icon for Nimbostratus rankNimbostratus
Jun 10, 2016

Handshake fails with error TLS_FALLBACK_SCSV with a lower protocol (86)

Usually handshake failures are caused by no cipher suite overlap between our Big-IP and the target server, but this one is different. I see in a packet capture that on the external side Big-IP sends Client Hello and the server responds with Server Hello with the chosen cipher suite etc. From the experience I have I see no problems with this exchange, but Big-IP still resets the connection. On the internal side the client only sends Client Hello before Big-IP resets the connection. Here is the output from SSL debug in /var/log/ltm.

 

Jun 10 10:42:06 pri-f5 info tmm2[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50517 -> 77.88.21.127:443

 

Jun 10 10:42:06 pri-f5 info tmm2[5135]: 01260013:6: SSL Handshake failed for TCP 77.88.21.127:443 -> X.X.119.254:50517

 

Jun 10 10:42:06 pri-f5 info tmm3[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50516 -> 77.88.21.127:443

 

Jun 10 10:42:06 pri-f5 info tmm3[5135]: 01260013:6: SSL Handshake failed for TCP 77.88.21.127:443 -> X.X.119.254:50516

 

Jun 10 10:42:06 pri-f5 info tmm1[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50518 -> 77.88.21.127:443

 

Jun 10 10:42:06 pri-f5 info tmm1[5135]: 01260013:6: SSL Handshake failed for TCP 77.88.21.127:443 -> X.X.119.254:50518

 

Jun 10 10:42:06 pri-f5 debug tmm[5135]: 01260009:7: Connection error: ssl_select_suite:5814: TLS_FALLBACK_SCSV with a lower protocol (86)

 

Jun 10 10:42:06 pri-f5 info tmm[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50519 -> 77.88.21.127:443

 

What could be going wrong here and how can I proceed to figure it out?