Thanks Pushkar. I had a config error in my multi cert config file. I was
missing ‘dest_ip=*’
Dk.
> On Nov 2, 2018, at 11:53 AM, Pushkar Pradhan <pprad...@oath.com.INVALID>
> wrote:
>
> Is your client sending a TLSv1.2 handshake? Maybe it's a lower version or
> non TLS.
>
>> On Fri, Nov 2, 2018 at 11:41 AM Dk Jack <dnj0...@gmail.com> wrote:
>>
>> Hi,
>> I enabled SSL on my ATS and my ssl requests are failing with handshake
>> error. From the logs I can tell that it loaded my cert/key correct. When I
>> started traffic server in debug mode (./traffic_server -T ssl), I am seeing
>> the following error
>>
>> SSL routines:ssl3_get_client_hello:no shared cipher
>>
>> My TLS config is shown below. My cert is a self signed signed cert. My ATS
>> version is 6.2.1. I'd appreciate any pointers on how to resolve this.
>> Thanks.
>>
>> Dk.
>>
>> CONFIG proxy.config.ssl.SSLv2 INT 0
>> CONFIG proxy.config.ssl.SSLv3 INT 1
>> CONFIG proxy.config.ssl.TLSv1 INT 1
>> CONFIG proxy.config.ssl.TLSv1_1 INT 1
>> CONFIG proxy.config.ssl.TLSv1_2 INT 1
>> CONFIG proxy.config.ssl.server.cipher_suite STRING
>>
>> AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!LOW:!MD5:!SSLV2:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
>> CONFIG proxy.config.ssl.server.honor_cipher_order INT 1
>> CONFIG proxy.config.ssl.compression INT 0
>>
>>
>> Debug logs:
>> [Nov 2 18:16:07.664] Server {0x7f8822572700} DEBUG:
>> <SSLNextProtocolAccept.cc:129 (mainEvent)> (ssl)
>> [SSLNextProtocolAccept:mainEvent] event 202 netvc 0x7f8820072800
>> [Nov 2 18:16:07.664] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:981 (sslStartHandShake)> (ssl) IP context is (nil)
>> for [10.3.28.146:39678] -> [172.19.0.2:7453], default context 0x2d82bc0
>> [Nov 2 18:16:07.664] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:1671
>> (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x7f87d4021100 where: 16
>> ret: 1
>> [Nov 2 18:16:07.664] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:1671
>> (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x7f87d4021100 where:
>> 8193 ret: 1
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:1402 (select_next_protocol)> (ssl) selected ALPN
>> protocol http/1.1
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:284
>> (set_context_cert)> (ssl) set_context_cert ssl=0x7f87d4021100 server=(null)
>> handshake_complete=0
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:336
>> (set_context_cert)> (ssl) ssl_cert_callback using SSL context 0x2d82bc0 for
>> requested name '(null)'
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:1462 (callHooks)> (ssl) callHooks
>> sslHandshakeHookState=0
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:1671
>> (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x7f87d4021100 where:
>> 16392 ret: 552
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:1671
>> (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x7f87d4021100 where:
>> 8194 ret: -1
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:1671
>> (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x7f87d4021100 where:
>> 8194 ret: -1
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG: <SSLUtils.cc:2126
>> (SSLAccept)> (ssl.error.accept) SSL accept returned -1, ssl_error=1,
>> ERR_get_error=336109761 (error:1408A0C1:SSL
>> routines:ssl3_get_client_hello:no shared cipher)
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:1105 (sslServerHandShakeEvent)> (ssl) trace=FALSE
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:1109 (sslServerHandShakeEvent)> (ssl)
>> SSL::140222668416768:error:1408A0C1:SSL routines:ssl3_get_client_hello:no
>> shared cipher:s3_srvr.c:1417: peer address is 10.3.28.146
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:1109 (sslServerHandShakeEvent)> (ssl) SSL handshake
>> error: SSL_ERROR_SSL (1), errno=0
>> [Nov 2 18:16:07.665] Server {0x7f8822572700} DEBUG:
>> <SSLNetVConnection.cc:1237 (sslServerHandShakeEvent)> (ssl)
>> SSLNetVConnection::sslServerHandShakeEvent, SSL_ERROR_SSL errno=0
>> ^Ctraffic_server: Interrupt (Signal sent by the kernel 0 0)
>>
>
>
> --
> pushkar
