Nginx server closes ssl connection for some clients
<p>I have been having some problems with https connections on a box running nginx.
Most browsers I have tried work, but some Safari-versions, and openssl fails to connect.
<a href="https://www.ssllabs.com/ssltest/analyze.html?d=test.relis.no" rel="nofollow">https://www.ssllabs.com/ssltest/analyze.html?d=test.relis.no</a>
show many attemts as "Server closed connection"</p>

<p>The problem seems to be connected to cipher suits based on some things I have read while googling log content. </p>

<blockquote>
  <p>When connecting with <code>openssl s_client -connect test.relis.no:443</code>:
  CONNECTED(00000003)</p>
  
  <h2>write:errno=104</h2>
  
  <h2>no peer certificate available</h2>
  
  <h2>No client certificate CA names sent</h2>
  
  <h2>SSL handshake has read 0 bytes and written 295 bytes</h2>
  
  <p>New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE</p>
  
  <h2>Expansion: NONE</h2>
</blockquote>

<p>Nginx config: </p>

<pre><code>server {
        listen       443 ssl;
        server_name  test.relis.no;

        location / {
            proxy_pass http://localhost:8081;
            proxy_read_timeout 3600;
        }

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto https;

        ssl_certificate /etc/letsencrypt/live/test.relis.no/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/test.relis.no/privkey.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        ssl_ciphers ALL;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        add_header Strict-Transport-Security max-age=15768000;
}
</code></pre>

<p>(ssl_ciphers ALL; is just for testing) </p>

<p>Adding debug connection information yields(this client is Safari on Ipad): </p>

<pre><code>13409#0: *390 accept: 195.18.161.2 fd:3
 13409#0: posix_memalign: 00007F8FF0719A90:256 @16
 13409#0: *390 event timer add: 3: 60000:1463745705191
 13409#0: *390 reusable connection: 1
 13409#0: *390 epoll add event: fd:3 op:1 ev:80002001
 13409#0: *390 http check ssl handshake
 13409#0: *390 http recv(): 1
 13409#0: *390 https ssl handshake: 0x16
 13409#0: *390 SSL server name: "test.relis.no"
 13409#0: *390 SSL NPN advertised
 13409#0: *390 SSL_do_handshake: -1
 13409#0: *390 SSL_get_error: 2
 13409#0: *390 reusable connection: 0
 13409#0: *390 SSL handshake handler: 0
 13409#0: *390 SSL_do_handshake: -1
 13409#0: *390 SSL_get_error: 5
  2016/05/20 14:00:45 [info] 13409#0: *390 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 195.18.161.2, server: 0.0.0.0:443
 13409#0: *390 close http connection: 3
 13409#0: *390 SSL_shutdown: 1
 13409#0: *390 event timer del: 3: 1463745705191
 13409#0: *390 reusable connection: 0
 13409#0: *390 free: 00007F8FF0731FF0, unused: 3
 13409#0: *390 free: 00007F8FF0719A90, unused: 136
 13409#0: *391 accept: 195.18.161.2 fd:3
 13409#0: posix_memalign: 00007F8FF0719A90:256 @16
 13409#0: *391 event timer add: 3: 60000:1463745705259
 13409#0: *391 reusable connection: 1
 13409#0: *391 epoll add event: fd:3 op:1 ev:80002001
 13409#0: *391 http check ssl handshake
 13409#0: *391 http recv(): 1
 13409#0: *391 https ssl handshake: 0x16
 13409#0: *391 SSL_do_handshake: -1
 13409#0: *391 SSL_get_error: 1
  2016/05/20 14:00:45 [info] 13409#0: *391 SSL_do_handshake() failed (SSL: error:140A1175:SSL routines:SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback) while SSL handshaking, client: 195.18.161.2, server: 0.0.0.0:443
 13409#0: *391 close http connection: 3
 13409#0: *391 SSL_shutdown: 1
 13409#0: *391 event timer del: 3: 1463745705259
 13409#0: *391 reusable connection: 0
 13409#0: *391 free: 00007F8FF0731FF0, unused: 16
 13409#0: *391 free: 00007F8FF0719A90, unused: 136
 13409#0: *392 accept: 195.18.161.2 fd:3
 13409#0: posix_memalign: 00007F8FF0719A90:256 @16
 13409#0: *392 event timer add: 3: 60000:1463745705310
 13409#0: *392 reusable connection: 1
 13409#0: *392 epoll add event: fd:3 op:1 ev:80002001
 13409#0: *392 http check ssl handshake
 13409#0: *392 http recv(): 1
 13409#0: *392 https ssl handshake: 0x16
 13409#0: *392 SSL_do_handshake: -1
 13409#0: *392 SSL_get_error: 1
  2016/05/20 14:00:45 [info] 13409#0: *392 SSL_do_handshake() failed (SSL: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number) while SSL handshaking, client: 195.18.161.2, server: 0.0.0.0:443
 13409#0: *392 close http connection: 3
 13409#0: *392 SSL_shutdown: 1
 13409#0: *392 event timer del: 3: 1463745705310
 13409#0: *392 reusable connection: 0
 13409#0: *392 free: 00007F8FF0731FF0, unused: 16
 13409#0: *392 free: 00007F8FF0719A90, unused: 136
</code></pre>

<p>OpenSSL(version 1.0.1e-fips 11 Feb 2013) ciphers prints: </p>

<pre><code>ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
DHE-RSA-CAMELLIA256-SHA
DHE-DSS-CAMELLIA256-SHA
ECDH-RSA-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-ECDSA-AES256-SHA384
ECDH-RSA-AES256-SHA
ECDH-ECDSA-AES256-SHA
AES256-GCM-SHA384
AES256-SHA256
AES256-SHA
CAMELLIA256-SHA
PSK-AES256-CBC-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
DHE-DSS-AES128-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-ECDSA-DES-CBC3-SHA
DHE-RSA-SEED-SHA
DHE-DSS-SEED-SHA
DHE-RSA-CAMELLIA128-SHA
DHE-DSS-CAMELLIA128-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
ECDH-RSA-AES128-SHA
ECDH-ECDSA-AES128-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-ECDSA-DES-CBC3-SHA
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
SEED-SHA
CAMELLIA128-SHA
DES-CBC3-SHA
IDEA-CBC-SHA
PSK-AES128-CBC-SHA
PSK-3DES-EDE-CBC-SHA
KRB5-IDEA-CBC-SHA
KRB5-DES-CBC3-SHA
KRB5-IDEA-CBC-MD5
KRB5-DES-CBC3-MD5
ECDHE-RSA-RC4-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-RSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
RC4-SHA
RC4-MD5
PSK-RC4-SHA
KRB5-RC4-SHA
KRB5-RC4-MD5
</code></pre>

<p><strong>ldd <code>which nginx</code> | grep ssl</strong>:
    libssl.so.10 => /lib64/libssl.so.10 (0x00007f413c860000)</p>

<p><strong>nginx -V</strong>:</p>

<pre><code>nginx version: nginx/1.6.3
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) 
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_spdy_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_image_filter_module --with-http_geoip_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_stub_status_module --with-http_perl_module --with-mail --with-mail_ssl_module --with-pcre --with-pcre-jit --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
</code></pre>