40

NGINX acting as a caching proxy encounters problems when fetching content from CloudFront server over HTTPS:

This is the extract from the NGINX's error log:

2014/08/14 16:08:26 [error] 27534#0: *11560993 SSL_do_handshake() failed (SSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure) while SSL handshaking to upstream, client: 82.33.49.135, server: localhost, request: "GET /static/images/media-logos/best.png HTTP/1.1", upstream: "https://x.x.x.x:443/static/images/media-logos/best.png",

I tried different proxy setting like proxy_ssl_protocols and proxy_ssl_ciphers but no combination worked.

Any ideas?

1 Answer 1

102

I had the exactly same problem and spent a couple of hours... I guess you are using older version of nginx (lower than 1.7)? In nginx 1.7 you can use this directive:

proxy_ssl_server_name on;

This will force nginx to use SNI Also, you should set the SSL protocols:

proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

For earlier versions you may be able to use this patch (but I can't verify that that is working):

http://trac.nginx.org/nginx/ticket/229

2019 Update: You should avoid TLSv1 and TLSv1.1 and disable them if possible. I'll leave them in the answer as they are still valid for SNI.

7
  • 6
    I'm using Cloudflare for HTTPS, which uses SNI. Making this change solved the problem - you are a godsend, thanks!
    – Patrick
    Jun 5, 2017 at 2:21
  • Thanks for this! Since I was using multiple upstreams, I also ended up needing to add proxy_ssl_name upstream-name.com; for it to work.
    – kenske
    May 10, 2018 at 7:37
  • I keep getting unknown directive "proxy_ssl_server_name" I am using nginx v1.10. Dont know why I have this problem?
    – Igor-Vuk
    Jun 7, 2018 at 11:45
  • @Igor-Vuk, maybe you don't have SSL compiled in nginx? Jun 21, 2018 at 6:38
  • I faced same issue on nginx/1.12.2 and after adding above line it worked. Thanks
    – Kaushal
    Sep 4, 2018 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.