Hello everyone,

I have an issue with logging SSL handshake failure errors for a particular client IP for my nginx configurations. My server lies on a vagrant local VM, and I am accessing the website hosted on the VM by my local machine. What I would like to do is that when an outdated server certificate fails on the client, I am able to log this failure along with the Client IP.

This is what my nginx.conf configuration look like:

user vagrant;
worker_processes auto;


error_log /var/log/nginx/error.log debug;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
worker_connections 1024;
# multi_accept on;
}

http {

##
# Basic Settings
##

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;

# server_names_hash_bucket_size 64;
# server_name_in_redirect off;

# defining log format
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$ssl_protocol '
'$status $body_bytes_sent "$host" "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';


include /etc/nginx/mime.types;
default_type application/octet-stream;

##
# SSL Settings
##

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;


##
# Logging Settings
##

access_log /var/log/nginx/access.log main;


##
# Gzip Settings
##
gzip on;

# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

##
# Virtual Host Configs
##

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}

And my single server configuration (inside /etc/nginx/sites-enabled) looks like this:

server {

# listen on port 443 (https)

listen 443 ssl;
server_name www.domain.org domain.org;

# location of the self-signed SSL certificate

ssl_certificate /home/vagrant/certs/domain.org.crt;
ssl_certificate_key /home/vagrant/domain.org.key;

#log SSL errors

error_log /var/log/nginx/error_tls_2.log debug;

location / {

# forward application requests to the gunicorn server

proxy_pass http://localhost:8000;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

}


As you can see, I have turned debug on for errors, and I believe this should log the ssl handshake failure error. However, when I look at my error_log_tls.log file (where I am logging the errors), all I see is the following:

2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN supported by client: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN selected: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL handshake handler: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL: TLSv1.2, cipher: "ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD"
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 5
2019/04/11 22:43:02 [debug] 3086#3086: *27 peer shutdown SSL cleanly
2019/04/11 22:43:02 [info] 3086#3086: *27 client closed connection while waiting for request, client: 192.168.33.1, server: 0.0.0.0:443
2019/04/11 22:43:02 [debug] 3086#3086: *27 close http connection: 4
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_shutdown: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 event timer del: 4: 2302465
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0A855C0, unused: 24

Could anyone help with this?