Nginx: peer closed connection in SSL handshake while SSL handshaking to upstream

Question

I have this new client which only can talk TLSv1.2 which communicate with a old service which can only talk TLSv1. It is about to be upgraded. It is an internal system without access to internet.

To solve the problem I have placed a Nginx proxy in between.

client =TLS1.2=> Nginx =TLSv1=> oldservice

Even with proxy_ssl_verify=off I get this error:

==> /var/log/nginx/ngx-error.log <==

2021/09/15 14:48:26 [error] 13231#0: *3 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 10.140.164.9, server: ngx.example.org, request: "GET /net/EXT/microservice.svc HTTP/1.1", upstream: "https://172.23.149.10:443/EXT/microservice.svc", host: "ngx.example.org"

If I on ngx.example.org run curl -v https://endp.example.org/EXT/microservice.svc I get this message:

* NSS error -8016 (SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED)
* The certificate was signed using a signature algorithm that is disabled because it is not secure.
* Closing connection 0
curl: (60) The certificate was signed using a signature algorithm that is disabled because it is not secure.

If I run curl --insecure it is working and this is the behavior I want Nginx to do.

My Nginx configuration:

server {
  listen 80;
  listen 443 ssl;
  server_name ngx.example.org;
  access_log /var/log/nginx/ngx-access.log;
  error_log /var/log/nginx/ngx-error.log;
  root /var/www/nginx/ngx;
  ssl_protocols TLSv1.2;
  ssl_certificate  /etc/pki/nginx/private/ngx.example.org.crt;
  ssl_certificate_key /etc/pki/nginx/private/ngx.example.org.key;
  ssl_verify_client off;
  proxy_ssl_server_name on;
  proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  #proxy_ssl_ciphers PSK-3DES-EDE-CBC-SHA;
  location /net/ {
    proxy_ssl_name endp.example.org;
    proxy_ssl_server_name on;
    proxy_ssl_verify off;
    proxy_ssl_trusted_certificate /etc/pki/ca-trust/source/anchors/wsgw.root.ca.pem;
    proxy_set_header Host endp.example.org;
    proxy_set_header X_FORWARDED_PROTO https;
    proxy_pass https://endp.example.org/;
  }
}

Edit:

Here is the output from openssl without -tlsv1:

openssl s_client -connect endp.example.org:443

139801673865104:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:

CONNECTED(00000003)
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 289 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1631880896
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Here is the output from openssl with -tlsv1:

openssl s_client -connect endp.example.org:443 -tls1
 
depth=0 CN = endp.example.org
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = endp.example.org
verify return:1
CONNECTED(00000003)
---
Certificate chain
0 s:/CN=endp.example.org
   i:/CN=endp.example.org
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICIzCCAYygAwIBAgIQZs9VZsp/iZRC2rL+oYTf0DANBgkqhkiG9w0BAQQFADAc
...lines deleted
OS+ih0tnXEzJKqtSC52Z+zAIFWdEipA=
-----END CERTIFICATE-----
subject=/CN=endp.example.org
issuer=/CN=endp.example.org
---
No client certificate CA names sent
---
SSL handshake has read 694 bytes and written 363 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-MD5
    Session-ID: A01E00002B40C49CA7D7CD8EE73A9FB8DF44BF155300CDFCC98712657F697F88
    Session-ID-ctx:
    Master-Key: A90284275AA0067A47836A269592213E419F5286E0D30EA38F1094B50536F67913FCE7BA5D43025D1AC7FBDCA769FBE4
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1631862396
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)

Content of certificate:

$ openssl x509 -in endp.example.org.crt -text -noout
Certificate:
    Data:
       Version: 3 (0x2)
        Serial Number:
            66:cf:55:66:ca:7f:89:94:42:da:b2:fe:a1:84:df:d0
    Signature Algorithm: md5WithRSAEncryption
        Issuer: CN=endp.example.org
        Validity
            Not Before: Nov  9 11:08:50 2010 GMT
            Not After : Dec 30 23:00:00 2030 GMT
        Subject: CN=endp.example.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:eb:ea:04:f0:53:87:26:b5:19:13:c6:a5:7b:27:
                    75:7e:f5:9a:84:74:59:d3:ec:0d:40:42:78:a4:c6:
                    1b:42:b2:50:19:3e:90:7b:20:73:f4:71:b8:3b:c3:
                    b3:dd:84:94:78:64:64:ac:5c:dc:a3:e4:8c:36:10:
                    32:ec:12:90:89:6c:e9:44:0e:fb:2e:84:0f:df:16:
                    c2:ae:b8:2c:d6:d0:73:b3:cf:4b:f8:56:91:e6:30:
                    c1:15:34:9f:70:6d:e1:e9:33:de:d6:9b:4d:2e:c8:
                    03:7b:eb:ed:6b:9c:8e:0b:80:a2:ef:29:5f:18:4e:
                    bf:e3:9a:81:e3:57:ae:c5:3f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            2.5.29.1:
                0D....M..w....T..."...0.1.0...U....endp.example.org..f.Uf....B.......
    Signature Algorithm: md5WithRSAEncryption
         83:a7:c9:cf:a5:d3:91:78:65:d0:43:24:84:c5:77:62:be:ba:
         52:db:7f:c6:ca:59:40:50:91:5f:48:fe:77:4a:94:26:36:23:
         3a:82:6b:54:46:c1:a4:0d:bd:8f:96:bc:04:c8:54:f7:74:94:
         83:3a:9e:71:61:8c:d4:a0:77:be:fc:50:e8:3f:12:a3:00:01:
         9d:d6:06:a0:77:c2:84:24:96:03:c1:6a:05:57:bb:5e:d0:47:
         e5:ff:a9:6c:a1:e1:cc:a4:d0:4b:b0:9d:1b:0b:d4:39:2f:a2:
         87:4b:67:5c:4c:c9:2a:ab:52:0b:9d:99:fb:30:08:15:67:44:
         8a:90

Nginx: peer closed connection in SSL handshake while SSL handshaking to upstream

Answers (1)

Related Questions