K
Q

Question

Nginx ingress controller how to fix SSL_do_handshake tls_process_client_hello:version too low) while SSL handshaking

9/15/2018

In my kubernetes Ingress controller logging lots of handshake message like this. how to stop this error message? it appers request coming from with-in the pod 127.0.0.1

2018/09/15 13:28:28 [crit] 21472#21472: *323765 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323766 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323767 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323768 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323769 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442

Here is ingress argument.

 - args:
        - /nginx-ingress-controller
        - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
        - --configmap=$(POD_NAMESPACE)/nginx-configuration
        - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
        - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
        - --publish-service=$(POD_NAMESPACE)/ingress-nginx
        - --annotations-prefix=nginx.ingress.kubernetes.io
        - --enable-ssl-chain-completion=false
        - --default-ssl-certificate=ingress-nginx/ingress-tls-secret
        - --enable-ssl-passthrough

Thanks

-- sfgroups

kubernetes

nginx

nginx-ingress

1 Answer

9/20/2018

My issue is with HAPROXY health check configuration I set to ssl-hello-chk now I changed it to tcp-check error message stopped.

change this:

mode tcp             
balance leastconn    
option ssl-hello-chk

to

 mode tcp         
 balance leastconn
 option tcp-check

-- sfgroups

Source: StackOverflow

KQ

Nginx ingress controller how to fix SSL_do_handshake tls_process_client_hello:version too low) while SSL handshaking

Similar Questions

1 Answer

K
Q