I'm using nginx for the first time so this could be my fault. I'm trying to use nginx as https reverse proxy to connect users to another https site. Both nginx and the redirected site are using the same certificate. Hopefully, that isn't the problem?

Here is what I have done so far and then I'll share the logs.

I first installed nginx on a windows server that has the https site I want customers to connect to. I was using port 443 for nginx and port 8060 for the other https site. I got the SSL handshake error 10054. I also get SSL_do_handshake: -1, SSL_get_error: 2, SSL_get_error: 5 in the debug.

I then tried to seperate the roles on two different servers. I built a CentOS 7 server and configured it and tried to redirect the https to the windows server on port 8060 and got the same error. So then I built another windows server and put nginx on it and tried and of course I got the same error.

I ran a wireshark which I'm not that knowledgable with and saw the client/server communication Hello etc and appeared to be fine when I hitting the nginx server or if I hit the windows server with the second https site. www.domain.com:8060. I get the correct response when hitting them direct, but I never see the redirect traffic. Maybe I don't have wireshark setup correctly?

Here is the whole message I receive: *1 peer closed connection in SSL handshake (10054: An existing connect was forcibly closed by the remote host) while SSL handshaking to upstream, client: "public IP address", server: "nginx public DNS name", request: "Get / HTTP/1.1", upstream: "https://public IP Address of 2nd https site:portnumber/", host: "nginx's public DNS server Name".

I used these commands to create my pem and key files: openssl pkcs12 -nocerts -nodes -in my.domain.com.p12 -out domain.key
and openssl pkcs12 -nokeys -in my.domain.com.p12 -out domain.pem.

Here is part of my configuration file:
listen 443 ssl;

server_name nginx's public DNS name nginx.domain.com;
underscores_in_headers on;

ssl_certificate C:\certs\domain.pem;
ssl_certificate_key C:\certs\domain.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_protocols SSLv2 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location / {
proxy_ssl_session_reuse off;
proxy_pass https://my.domain.com:8060/;
proxy_pass_request_headers on;

Note: I've tried the conf with proxy_ssl_session_reuse off in the conf and without it being in the conf file.

I"m using the same wildcard certificate for both sites.


2016/11/11 06:53:52 [debug] 732#3308: *1 http cleanup add: 01187680
2016/11/11 06:53:52 [debug] 732#3308: *1 get rr peer, try: 1
2016/11/11 06:53:52 [debug] 732#3308: *1 stream socket 440
2016/11/11 06:53:52 [debug] 732#3308: *1 connect to IPADDRESS:8060, fd:440 #4
2016/11/11 06:53:52 [debug] 732#3308: *1 select add event fd:440 ev:0
2016/11/11 06:53:52 [debug] 732#3308: *1 select add event fd:440 ev:1
2016/11/11 06:53:52 [debug] 732#3308: *1 http upstream connect: -2
2016/11/11 06:53:52 [debug] 732#3308: *1 malloc: 0110EDD0:128
2016/11/11 06:53:52 [debug] 732#3308: *1 event timer add: 440: 60000:1396542274
2016/11/11 06:53:52 [debug] 732#3308: *1 http finalize request: -4, "/?" a:1, c:2
2016/11/11 06:53:52 [debug] 732#3308: *1 http request count:2 blk:0
2016/11/11 06:53:52 [debug] 732#3308: worker cycle
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:380 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:436 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:428 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:432 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:440 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:440 wr:1
2016/11/11 06:53:52 [debug] 732#3308: select timer: 500
2016/11/11 06:53:52 [debug] 732#3308: select ready 1
2016/11/11 06:53:52 [debug] 732#3308: select write 440
2016/11/11 06:53:52 [debug] 732#3308: *1 post event 01158048
2016/11/11 06:53:52 [debug] 732#3308: timer delta: 0
2016/11/11 06:53:52 [debug] 732#3308: posted event 01158048
2016/11/11 06:53:52 [debug] 732#3308: *1 delete posted event 01158048
2016/11/11 06:53:52 [debug] 732#3308: *1 http upstream request: "/?"
2016/11/11 06:53:52 [debug] 732#3308: *1 http upstream send request handler
2016/11/11 06:53:52 [debug] 732#3308: *1 set session: 00000000
2016/11/11 06:53:52 [debug] 732#3308: *1 tcp_nodelay
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_do_handshake: -1
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_get_error: 2
2016/11/11 06:53:52 [debug] 732#3308: *1 select del event fd:440 ev:1
2016/11/11 06:53:52 [debug] 732#3308: worker cycle
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:380 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:436 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:428 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:432 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:440 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select timer: 500
2016/11/11 06:53:52 [debug] 732#3308: select ready 1
2016/11/11 06:53:52 [debug] 732#3308: select read 440
2016/11/11 06:53:52 [debug] 732#3308: *1 post event 01144040
2016/11/11 06:53:52 [debug] 732#3308: timer delta: 0
2016/11/11 06:53:52 [debug] 732#3308: posted event 01144040
2016/11/11 06:53:52 [debug] 732#3308: *1 delete posted event 01144040
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL handshake handler: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_do_handshake: -1
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_get_error: 5
2016/11/11 06:53:52 [error] 732#3308: *1 peer closed connection in SSL handshake (10054: An existing connection was forcibly closed by the remote host) while SSL handshaking to upstream, client: IPADDRESS, server: nginx.domain.com, request: "GET / HTTP/1.1", upstream: "https://IPADDress:8060/", host: "nginx.domain.com"
2016/11/11 06:53:52 [debug] 732#3308: *1 http next upstream, 2
2016/11/11 06:53:52 [debug] 732#3308: *1 free rr peer 1 4
2016/11/11 06:53:52 [debug] 732#3308: *1 finalize http upstream request: 502
2016/11/11 06:53:52 [debug] 732#3308: *1 finalize http proxy request
2016/11/11 06:53:52 [debug] 732#3308: *1 close http upstream connection: 440
2016/11/11 06:53:52 [debug] 732#3308: *1 free: 0110EDD0, unused: 52
2016/11/11 06:53:52 [debug] 732#3308: *1 event timer del: 440: 1396542274
2016/11/11 06:53:52 [debug] 732#3308: *1 select del event fd:440 ev:0
2016/11/11 06:53:52 [debug] 732#3308: *1 reusable connection: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 http finalize request: 502, "/?" a:1, c:1
2016/11/11 06:53:52 [debug] 732#3308: *1 http special response: 502, "/?"
2016/11/11 06:53:52 [debug] 732#3308: *1 HTTP/1.1 502 Bad Gateway
Server: nginx/1.11.4
Date: Fri, 11 Nov 2016 11:53:52 GMT
Content-Type: text/html
Content-Length: 575
Connection: keep-alive

2016/11/11 06:53:52 [debug] 732#3308: *1 write new buf t:1 f:0 011876D4, pos 011876D4, size: 157 file: 0, size: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 http write filter: l:0 f:0 s:157
2016/11/11 06:53:52 [debug] 732#3308: *1 http output filter "/?"
2016/11/11 06:53:52 [debug] 732#3308: *1 http copy filter: "/?"
2016/11/11 06:53:52 [debug] 732#3308: *1 malloc: 01187840:4096
2016/11/11 06:53:52 [debug] 732#3308: *1 http postpone filter "/?" 01187890
2016/11/11 06:53:52 [debug] 732#3308: *1 write old buf t:1 f:0 011876D4, pos 011876D4, size: 157 file: 0, size: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 write new buf t:0 f:0 00000000, pos 014B0878, size: 120 file: 0, size: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 write new buf t:0 f:0 00000000, pos 014AF6E0, size: 53 file: 0, size: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 write new buf t:0 f:0 00000000, pos 014AF748, size: 402 file: 0, size: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 http write filter: l:1 f:0 s:732
2016/11/11 06:53:52 [debug] 732#3308: *1 http write filter limit 0
2016/11/11 06:53:52 [debug] 732#3308: *1 malloc: 01198E68:16384
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL buf copy: 157
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL buf copy: 120
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL buf copy: 53
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL buf copy: 402
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL to write: 732
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_write: 732
2016/11/11 06:53:52 [debug] 732#3308: *1 http write filter 00000000
2016/11/11 06:53:52 [debug] 732#3308: *1 http copy filter: 0 "/?"
2016/11/11 06:53:52 [debug] 732#3308: *1 http finalize request: 0, "/?" a:1, c:1
2016/11/11 06:53:52 [debug] 732#3308: *1 set http keepalive handler
2016/11/11 06:53:52 [debug] 732#3308: *1 http close request
2016/11/11 06:53:52 [debug] 732#3308: *1 http log handler
2016/11/11 06:53:52 [debug] 732#3308: *1 free: 01186838, unused: 4
2016/11/11 06:53:52 [debug] 732#3308: *1 free: 01187840, unused: 3754
2016/11/11 06:53:52 [debug] 732#3308: *1 free: 01186430
2016/11/11 06:53:52 [debug] 732#3308: *1 hc free: 00000000 0
2016/11/11 06:53:52 [debug] 732#3308: *1 hc busy: 00000000 0
2016/11/11 06:53:52 [debug] 732#3308: *1 free: 01198E68
2016/11/11 06:53:52 [debug] 732#3308: *1 tcp_nodelay
2016/11/11 06:53:52 [debug] 732#3308: *1 reusable connection: 1
2016/11/11 06:53:52 [debug] 732#3308: *1 event timer add: 428: 65000:1396547274
2016/11/11 06:53:52 [debug] 732#3308: worker cycle
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:380 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:436 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:428 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:432 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select timer: 500
2016/11/11 06:53:52 [debug] 732#3308: select ready 1
2016/11/11 06:53:52 [debug] 732#3308: select read 436
2016/11/11 06:53:52 [debug] 732#3308: *3 post event 01143FF0
2016/11/11 06:53:52 [debug] 732#3308: timer delta: 109
2016/11/11 06:53:52 [debug] 732#3308: posted event 01143FF0
2016/11/11 06:53:52 [debug] 732#3308: *3 delete posted event 01143FF0
2016/11/11 06:53:52 [debug] 732#3308: *3 SSL handshake handler: 0
2016/11/11 06:53:52 [debug] 732#3308: *3 SSL_do_handshake: 1
2016/11/11 06:53:52 [debug] 732#3308: *3 select del event fd:436 ev:0
2016/11/11 06:53:52 [debug] 732#3308: *3 SSL: TLSv1, cipher: "ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1"
2016/11/11 06:53:52 [debug] 732#3308: *3 reusable connection: 1
2016/11/11 06:53:52 [debug] 732#3308: *3 http wait request handler
2016/11/11 06:53:52 [debug] 732#3308: *3 malloc: 0118B120:256
2016/11/11 06:53:52 [debug] 732#3308: *3 malloc: 01113D90:1024
2016/11/11 06:53:52 [debug] 732#3308: *3 SSL_read: -1
2016/11/11 06:53:52 [debug] 732#3308: *3 SSL_get_error: 2
2016/11/11 06:53:52 [debug] 732#3308: *3 select add event fd:436 ev:0
2016/11/11 06:53:52 [debug] 732#3308: *3 free: 01113D90
2016/11/11 06:53:52 [debug] 732#3308: worker cycle
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:380 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:432 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:428 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select event: fd:436 wr:0
2016/11/11 06:53:52 [debug] 732#3308: select timer: 500
2016/11/11 06:53:52 [debug] 732#3308: select ready 1
2016/11/11 06:53:52 [debug] 732#3308: select read 428
2016/11/11 06:53:52 [debug] 732#3308: *1 post event 01143F50
2016/11/11 06:53:52 [debug] 732#3308: timer delta: 125
2016/11/11 06:53:52 [debug] 732#3308: posted event 01143F50
2016/11/11 06:53:52 [debug] 732#3308: *1 delete posted event 01143F50
2016/11/11 06:53:52 [debug] 732#3308: *1 http keepalive handler
2016/11/11 06:53:52 [debug] 732#3308: *1 malloc: 01113D90:1024
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_read: 1
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_read: 364
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_read: -1
2016/11/11 06:53:52 [debug] 732#3308: *1 SSL_get_error: 2
2016/11/11 06:53:52 [debug] 732#3308: *1 reusable connection: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 malloc: 01186C38:4096
2016/11/11 06:53:52 [debug] 732#3308: *1 event timer del: 428: 1396547274
2016/11/11 06:53:52 [debug] 732#3308: *1 http process request line
2016/11/11 06:53:52 [debug] 732#3308: *1 http request line: "GET /favicon.ico HTTP/1.1"
2016/11/11 06:53:52 [debug] 732#3308: *1 http uri: "/favicon.ico"
2016/11/11 06:53:52 [debug] 732#3308: *1 http args: ""
2016/11/11 06:53:52 [debug] 732#3308: *1 http exten: "ico"
2016/11/11 06:53:52 [debug] 732#3308: *1 http process request header line
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "Host: nginx.domain.com"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "Connection: keep-alive"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "Accept: */*"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "DNT: 1"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "Referer: https://nginx.domain.com/"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "Accept-Encoding: gzip, deflate, sdch, br"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header: "Accept-Language: en-US,en;q=0.8,es;q=0.6"
2016/11/11 06:53:52 [debug] 732#3308: *1 http header done
2016/11/11 06:53:52 [debug] 732#3308: *1 generic phase: 0
2016/11/11 06:53:52 [debug] 732#3308: *1 rewrite phase: 1
2016/11/11 06:53:52 [debug] 732#3308: *1 test location: "/"
2016/11/11 06:53:52 [debug] 732#3308: *1 using configuration "/"
2016/11/11 06:53:52 [debug] 732#3308: *1 http cl:-1 max:1048576
2016/11/11 06:53:52 [debug] 732#3308: *1 rewrite phase: 3
2016/11/11 06:53:52 [debug] 732#3308: *1 post rewrite phase: 4
2016/11/11 06:53:52 [debug] 732#3308: *1 generic phase: 5
2016/11/11 06:53:52 [debug] 732#3308: *1 generic phase: 6
2016/11/11 06:53:52 [debug] 732#3308: *1 generic phase: 7
2016/11/11 06:53:52 [debug] 732#3308: *1 access phase: 8
2016/11/11 06:53:52 [debug] 732#3308: *1 access phase: 9
2016/11/11 06:53:52 [debug] 732#3308: *1 access phase: 10
2016/11/11 06:53:52 [debug] 732#3308: *1 post access phase: 11
2016/11/11 06:53:52 [debug] 732#3308: *1 http init upstream, client timer: 0

I appreciate any help.

Am I the only one to get the 10054 error? Is there anyone that can help me with this?

Thanks,

My problem was resolved. I was binding my certificate by hostname. I changed it to ipport and now it works.

Hi Jviola,

I also have identical problem, in both cases I am using the same wild card cert for nginx and upstream server. Could you be more clear on how you fixed this, and what you suspect the problem was.

Thanks
Shaun



Edited 1 time(s). Last edit at 02/07/2018 08:09AM by shaun.kiesewetter@gmail.com.