[openssl-users] Troubleshooting SSL connections

[Paul Greene]

Hello All,

I've got two servers that need to communicate with each other using SSL. 
The applications that are supposed to talk to each other are custom in 
house applications.

When I try to connect to the upstream server, you can see the initial 
connection established - "Connecting to "<upstream server><ip 
address>":8443 ... connected"

Then you get "Initiating SSL handshake. SSL handshake failed. Closed fd 
3. Unable to establish SSL connection"

The network path between the two servers is rather convoluted - the IP 
address of my server gets NATed at least twice, it passes through a 
couple of different firewalls, proxy servers, and load balancers. The 
upstream server is on a public IP address, but the path to get there is 
an internal network that doesn't hit the public internet directly.

As a test with the application administrator, I cloned my server and 
moved the cloned copy (vmware servers) to a public IP address and 
attempted the connection from there, and it worked without an issue. The 
connection was established and it started polling the upstream server 
the way it was supposed to. That should indicate that there isn't an 
issue with either the server I'm managing or the upstream server, and 
the problem must be somewhere in the network in between. (the upstream 
server has been up and running for at least a year, so I'm pretty sure 
there is no issue with their server itself)

There's three different tech support groups that I have to deal with to 
troubleshoot this issue. They all have monitored the traffic and seen 
the initial connection being established, so they believe there is 
nothing on their side blocking the traffic, but no one can determine why 
the SSL connection keeps failing. But something, somewhere in that 
network path is messing with the network stream when it comes to 
processing the SSL packets.

Sorry this post is rather convoluted and long winded - what I'm hoping 
is that someone might suggest what might be happening here that is 
messing with the connections (because this is an openssl list and the 
problem is related to failing ssl connections). I don't manage or have 
control over any of the network devices in between, so all I can do is 
suggest something "out of the box" that they might not have thought of 
before.

Thanks,

Paul