Welcome! Log In Create A New Profile

Advanced

How to log SSL handshake failure error along with Client IP

Posted by qptr1234 
How to log SSL handshake failure error along with Client IP
April 12, 2019 01:01PM
Hello everyone,

I have an issue with logging SSL handshake failure errors for a particular client IP for my nginx configurations. My server lies on a vagrant local VM, and I am accessing the website hosted on the VM by my local machine. What I would like to do is that when an outdated server certificate fails on the client, I am able to log this failure along with the Client IP.

This is what my nginx.conf configuration look like:

user vagrant;
worker_processes auto;


error_log /var/log/nginx/error.log debug;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
worker_connections 1024;
# multi_accept on;
}

http {

##
# Basic Settings
##

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;

# server_names_hash_bucket_size 64;
# server_name_in_redirect off;

# defining log format
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$ssl_protocol '
'$status $body_bytes_sent "$host" "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';


include /etc/nginx/mime.types;
default_type application/octet-stream;

##
# SSL Settings
##

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;


##
# Logging Settings
##

access_log /var/log/nginx/access.log main;


##
# Gzip Settings
##
gzip on;

# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

##
# Virtual Host Configs
##

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}

And my single server configuration (inside /etc/nginx/sites-enabled) looks like this:

server {

# listen on port 443 (https)

listen 443 ssl;
server_name www.domain.org domain.org;

# location of the self-signed SSL certificate

ssl_certificate /home/vagrant/certs/domain.org.crt;
ssl_certificate_key /home/vagrant/domain.org.key;

#log SSL errors

error_log /var/log/nginx/error_tls_2.log debug;

location / {

# forward application requests to the gunicorn server

proxy_pass http://localhost:8000;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

}


As you can see, I have turned debug on for errors, and I believe this should log the ssl handshake failure error. However, when I look at my error_log_tls.log file (where I am logging the errors), all I see is the following:

2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN supported by client: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN selected: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL handshake handler: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL: TLSv1.2, cipher: "ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD"
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 5
2019/04/11 22:43:02 [debug] 3086#3086: *27 peer shutdown SSL cleanly
2019/04/11 22:43:02 [info] 3086#3086: *27 client closed connection while waiting for request, client: 192.168.33.1, server: 0.0.0.0:443
2019/04/11 22:43:02 [debug] 3086#3086: *27 close http connection: 4
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_shutdown: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 event timer del: 4: 2302465
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0A855C0, unused: 24

Could anyone help with this?
Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 77
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready