title: Nginx server closes ssl connection for some clients
body: <p>I have been having some problems with https connections on a box running nginx.
  Most browsers I have tried work, but some Safari-versions, and openssl fails to connect.
  <a href="https://www.ssllabs.com/ssltest/analyze.html?d=test.relis.no" rel="nofollow">https://www.ssllabs.com/ssltest/analyze.html?d=test.relis.no</a>
  show many attemts as "Server closed connection"</p>
  
  <p>The problem seems to be connected to cipher suits based on some things I have read while googling log content. </p>
  
  <blockquote>
    <p>When connecting with <code>openssl s_client -connect test.relis.no:443</code>:
    CONNECTED(00000003)</p>
    
    <h2>write:errno=104</h2>
    
    <h2>no peer certificate available</h2>
    
    <h2>No client certificate CA names sent</h2>
    
    <h2>SSL handshake has read 0 bytes and written 295 bytes</h2>
    
    <p>New, (NONE), Cipher is (NONE)
    Secure Renegotiation IS NOT supported
    Compression: NONE</p>
    
    <h2>Expansion: NONE</h2>
  </blockquote>
  
  <p>Nginx config: </p>
  
  <pre><code>server {
          listen       443 ssl;
          server_name  test.relis.no;
  
          location / {
              proxy_pass http://localhost:8081;
              proxy_read_timeout 3600;
          }
  
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $remote_addr;
          proxy_set_header X-Forwarded-Proto https;
  
          ssl_certificate /etc/letsencrypt/live/test.relis.no/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/test.relis.no/privkey.pem;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
          ssl_prefer_server_ciphers on;
          ssl_dhparam /etc/ssl/certs/dhparam.pem;
  
          ssl_ciphers ALL;
          ssl_session_timeout 1d;
          ssl_session_cache shared:SSL:50m;
          add_header Strict-Transport-Security max-age=15768000;
  }
  </code></pre>
  
  <p>(ssl_ciphers ALL; is just for testing) </p>
  
  <p>Adding debug connection information yields(this client is Safari on Ipad): </p>
  
  <pre><code>13409#0: *390 accept: 195.18.161.2 fd:3
   13409#0: posix_memalign: 00007F8FF0719A90:256 @16
   13409#0: *390 event timer add: 3: 60000:1463745705191
   13409#0: *390 reusable connection: 1
   13409#0: *390 epoll add event: fd:3 op:1 ev:80002001
   13409#0: *390 http check ssl handshake
   13409#0: *390 http recv(): 1
   13409#0: *390 https ssl handshake: 0x16
   13409#0: *390 SSL server name: "test.relis.no"
   13409#0: *390 SSL NPN advertised
   13409#0: *390 SSL_do_handshake: -1
   13409#0: *390 SSL_get_error: 2
   13409#0: *390 reusable connection: 0
   13409#0: *390 SSL handshake handler: 0
   13409#0: *390 SSL_do_handshake: -1
   13409#0: *390 SSL_get_error: 5
    2016/05/20 14:00:45 [info] 13409#0: *390 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 195.18.161.2, server: 0.0.0.0:443
   13409#0: *390 close http connection: 3
   13409#0: *390 SSL_shutdown: 1
   13409#0: *390 event timer del: 3: 1463745705191
   13409#0: *390 reusable connection: 0
   13409#0: *390 free: 00007F8FF0731FF0, unused: 3
   13409#0: *390 free: 00007F8FF0719A90, unused: 136
   13409#0: *391 accept: 195.18.161.2 fd:3
   13409#0: posix_memalign: 00007F8FF0719A90:256 @16
   13409#0: *391 event timer add: 3: 60000:1463745705259
   13409#0: *391 reusable connection: 1
   13409#0: *391 epoll add event: fd:3 op:1 ev:80002001
   13409#0: *391 http check ssl handshake
   13409#0: *391 http recv(): 1
   13409#0: *391 https ssl handshake: 0x16
   13409#0: *391 SSL_do_handshake: -1
   13409#0: *391 SSL_get_error: 1
    2016/05/20 14:00:45 [info] 13409#0: *391 SSL_do_handshake() failed (SSL: error:140A1175:SSL routines:SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback) while SSL handshaking, client: 195.18.161.2, server: 0.0.0.0:443
   13409#0: *391 close http connection: 3
   13409#0: *391 SSL_shutdown: 1
   13409#0: *391 event timer del: 3: 1463745705259
   13409#0: *391 reusable connection: 0
   13409#0: *391 free: 00007F8FF0731FF0, unused: 16
   13409#0: *391 free: 00007F8FF0719A90, unused: 136
   13409#0: *392 accept: 195.18.161.2 fd:3
   13409#0: posix_memalign: 00007F8FF0719A90:256 @16
   13409#0: *392 event timer add: 3: 60000:1463745705310
   13409#0: *392 reusable connection: 1
   13409#0: *392 epoll add event: fd:3 op:1 ev:80002001
   13409#0: *392 http check ssl handshake
   13409#0: *392 http recv(): 1
   13409#0: *392 https ssl handshake: 0x16
   13409#0: *392 SSL_do_handshake: -1
   13409#0: *392 SSL_get_error: 1
    2016/05/20 14:00:45 [info] 13409#0: *392 SSL_do_handshake() failed (SSL: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number) while SSL handshaking, client: 195.18.161.2, server: 0.0.0.0:443
   13409#0: *392 close http connection: 3
   13409#0: *392 SSL_shutdown: 1
   13409#0: *392 event timer del: 3: 1463745705310
   13409#0: *392 reusable connection: 0
   13409#0: *392 free: 00007F8FF0731FF0, unused: 16
   13409#0: *392 free: 00007F8FF0719A90, unused: 136
  </code></pre>
  
  <p>OpenSSL(version 1.0.1e-fips 11 Feb 2013) ciphers prints: </p>
  
  <pre><code>ECDHE-RSA-AES256-GCM-SHA384
  ECDHE-ECDSA-AES256-GCM-SHA384
  ECDHE-RSA-AES256-SHA384
  ECDHE-ECDSA-AES256-SHA384
  ECDHE-RSA-AES256-SHA
  ECDHE-ECDSA-AES256-SHA
  DHE-DSS-AES256-GCM-SHA384
  DHE-RSA-AES256-GCM-SHA384
  DHE-RSA-AES256-SHA256
  DHE-DSS-AES256-SHA256
  DHE-RSA-AES256-SHA
  DHE-DSS-AES256-SHA
  DHE-RSA-CAMELLIA256-SHA
  DHE-DSS-CAMELLIA256-SHA
  ECDH-RSA-AES256-GCM-SHA384
  ECDH-ECDSA-AES256-GCM-SHA384
  ECDH-RSA-AES256-SHA384
  ECDH-ECDSA-AES256-SHA384
  ECDH-RSA-AES256-SHA
  ECDH-ECDSA-AES256-SHA
  AES256-GCM-SHA384
  AES256-SHA256
  AES256-SHA
  CAMELLIA256-SHA
  PSK-AES256-CBC-SHA
  ECDHE-RSA-AES128-GCM-SHA256
  ECDHE-ECDSA-AES128-GCM-SHA256
  ECDHE-RSA-AES128-SHA256
  ECDHE-ECDSA-AES128-SHA256
  ECDHE-RSA-AES128-SHA
  ECDHE-ECDSA-AES128-SHA
  DHE-DSS-AES128-GCM-SHA256
  DHE-RSA-AES128-GCM-SHA256
  DHE-RSA-AES128-SHA256
  DHE-DSS-AES128-SHA256
  DHE-RSA-AES128-SHA
  DHE-DSS-AES128-SHA
  ECDHE-RSA-DES-CBC3-SHA
  ECDHE-ECDSA-DES-CBC3-SHA
  DHE-RSA-SEED-SHA
  DHE-DSS-SEED-SHA
  DHE-RSA-CAMELLIA128-SHA
  DHE-DSS-CAMELLIA128-SHA
  EDH-RSA-DES-CBC3-SHA
  EDH-DSS-DES-CBC3-SHA
  ECDH-RSA-AES128-GCM-SHA256
  ECDH-ECDSA-AES128-GCM-SHA256
  ECDH-RSA-AES128-SHA256
  ECDH-ECDSA-AES128-SHA256
  ECDH-RSA-AES128-SHA
  ECDH-ECDSA-AES128-SHA
  ECDH-RSA-DES-CBC3-SHA
  ECDH-ECDSA-DES-CBC3-SHA
  AES128-GCM-SHA256
  AES128-SHA256
  AES128-SHA
  SEED-SHA
  CAMELLIA128-SHA
  DES-CBC3-SHA
  IDEA-CBC-SHA
  PSK-AES128-CBC-SHA
  PSK-3DES-EDE-CBC-SHA
  KRB5-IDEA-CBC-SHA
  KRB5-DES-CBC3-SHA
  KRB5-IDEA-CBC-MD5
  KRB5-DES-CBC3-MD5
  ECDHE-RSA-RC4-SHA
  ECDHE-ECDSA-RC4-SHA
  ECDH-RSA-RC4-SHA
  ECDH-ECDSA-RC4-SHA
  RC4-SHA
  RC4-MD5
  PSK-RC4-SHA
  KRB5-RC4-SHA
  KRB5-RC4-MD5
  </code></pre>
  
  <p><strong>ldd <code>which nginx</code> | grep ssl</strong>:
      libssl.so.10 => /lib64/libssl.so.10 (0x00007f413c860000)</p>
  
  <p><strong>nginx -V</strong>:</p>
  
  <pre><code>nginx version: nginx/1.6.3
  built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) 
  TLS SNI support enabled
  configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_spdy_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_image_filter_module --with-http_geoip_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_stub_status_module --with-http_perl_module --with-mail --with-mail_ssl_module --with-pcre --with-pcre-jit --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
  </code></pre>