SSL A lot of "SSL_do_handshake() failed (SSL: error"

Please fill in any relevant information that applies to you:

• CentOS Version: CentOS 7 64bit
• Centmin Mod Version Installed: 123.09beta01
• Nginx Version Installed: 1.11.12

Code:

2017/04/04 16:16:01 [crit] 26949#0: *9389241 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 94.100.224.164, server: 0.0.0.0:443
2017/04/04 16:23:48 [crit] 26946#0: *9402630 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 222.127.163.148, server: 0.0.0.0:443
2017/04/04 16:24:29 [crit] 26948#0: *9403753 SSL_do_handshake() failed (SSL: error:060BC064:digital envelope routines:AEAD_AES_GCM_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 121.54.44.165, server: 0.0.0.0:443
2017/04/04 16:29:56 [crit] 26946#0: *9412467 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 130.105.209.91, server: 0.0.0.0:443
2017/04/04 16:38:28 [crit] 26945#0: *9428662 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.203.157.188, server: 0.0.0.0:443
2017/04/04 16:39:48 [crit] 26947#0: *9431036 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.203.157.188, server: 0.0.0.0:443
2017/04/04 16:41:02 [crit] 26951#0: *9433244 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.209.241.79, server: 0.0.0.0:443
2017/04/04 16:41:36 [crit] 26945#0: *9434190 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.118.124, server: 0.0.0.0:443
2017/04/04 16:41:46 [crit] 26948#0: *9434453 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.75.10, server: 0.0.0.0:443
2017/04/04 16:44:35 [crit] 26949#0: *9439168 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 175.158.201.15, server: 0.0.0.0:443
2017/04/04 16:45:56 [crit] 26949#0: *9441640 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.102.111, server: 0.0.0.0:443
2017/04/04 16:46:33 [crit] 26946#0: *9442706 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 124.6.155.52, server: 0.0.0.0:443
2017/04/04 16:52:04 [crit] 26949#0: *9452478 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 122.52.156.239, server: 0.0.0.0:443
2017/04/04 16:54:11 [crit] 26946#0: *9456554 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.73.156, server: 0.0.0.0:443
2017/04/04 16:55:33 [crit] 26947#0: *9459016 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.73.156, server: 0.0.0.0:443
2017/04/04 16:55:36 [crit] 26947#0: *9459194 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 222.127.135.84, server: 0.0.0.0:443
2017/04/04 16:57:35 [crit] 26948#0: *9462788 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.75.160, server: 0.0.0.0:443
2017/04/04 17:01:28 [crit] 26947#0: *9469785 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 203.177.28.183, server: 0.0.0.0:443
2017/04/04 17:04:34 [crit] 26945#0: *9475139 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 203.87.129.143, server: 0.0.0.0:443
2017/04/04 17:04:59 [crit] 26949#0: *9472796 SSL_read() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while processing HTTP/2 connection, client: 112.198.98.225, server: 0.0.0.0:443
2017/04/04 17:06:26 [crit] 26947#0: *9478339 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 180.190.67.120, server: 0.0.0.0:443
2017/04/04 17:11:43 [crit] 26951#0: *9487555 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 180.191.114.229, server: 0.0.0.0:443
2017/04/04 17:13:09 [crit] 26951#0: *9490010 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 72.143.239.250, server: 0.0.0.0:443
2017/04/04 17:14:06 [crit] 26951#0: *9491580 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 182.18.201.74, server: 0.0.0.0:443
2017/04/04 17:14:54 [crit] 26951#0: *9492963 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.207.221.172, server: 0.0.0.0:443
2017/04/04 17:15:17 [crit] 26948#0: *9493669 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 180.232.83.50, server: 0.0.0.0:443
2017/04/04 17:19:57 [crit] 26948#0: *9501405 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.118.78, server: 0.0.0.0:443
2017/04/04 17:21:04 [crit] 26949#0: *9503343 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 180.190.79.160, server: 0.0.0.0:443
2017/04/04 17:21:49 [crit] 26949#0: *9504617 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.205.184.135, server: 0.0.0.0:443
2017/04/04 17:25:45 [crit] 26948#0: *9511419 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 121.54.90.106, server: 0.0.0.0:443
2017/04/04 17:26:54 [crit] 26945#0: *9513385 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 124.104.40.81, server: 0.0.0.0:443
2017/04/04 17:32:05 [crit] 26945#0: *9522288 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 124.104.236.148, server: 0.0.0.0:443
2017/04/04 17:36:00 [crit] 26947#0: *9528959 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 198.215.36.5, server: 0.0.0.0:443
2017/04/04 17:41:02 [crit] 26949#0: *9537171 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 116.87.108.103, server: 0.0.0.0:443
2017/04/04 17:43:50 [crit] 26945#0: *9541541 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 49.2.86.141, server: 0.0.0.0:443
2017/04/04 17:47:24 [crit] 26948#0: *9547311 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.72.198, server: 0.0.0.0:443
2017/04/04 17:50:33 [crit] 26949#0: *9552111 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 121.54.32.163, server: 0.0.0.0:443
2017/04/04 17:55:01 [crit] 26946#0: *9559692 SSL_do_handshake() failed (SSL: error:060C1064:digital envelope routines:AEAD_CHACHA20_POLY1305_OPEN:bad decrypt error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 112.198.69.17, server: 0.0.0.0:443

---

 

My SSL Config:

Code:

    keepalive_timeout 300;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff";
        
    ssl_certificate /usr/local/nginx/conf/ssl/ssl-unified.crt;
    ssl_certificate_key /usr/local/nginx/conf/ssl/ssl.key;
    
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
    ssl_prefer_server_ciphers on;
    
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 24h;
    ssl_buffer_size 1400;

Taken from here: Generate Mozilla Security Recommended Web Server Configuration Files

 

Yes here it is:

Not relevant anymore now as I just switch to Openssl after posting this thread instead of LibreSSL.

Code:

nginx version: nginx/1.11.12
built by gcc 5.3.1 20160406 (Red Hat 5.3.1-6) (GCC)
built with OpenSSL 1.0.2k  26 Jan 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -g -O3 -fstack-protector-strong -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_realip_module --with-openssl=../openssl-1.0.2k --with-libatomic --with-pcre=../pcre-8.40 --with-pcre-jit --with-zlib=../zlib-1.2.11

Code:

/usr/local/nginx/conf/nginx.conf.default:108:    #    ssl_ciphers  HIGH:!aNULL:!MD5;
/usr/local/nginx/conf/ssl/domain1_ssl.conf:12:    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
/usr/local/nginx/conf/ssl/domain2.com_ssl.conf:9:    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
/usr/local/nginx/conf/ssl/domain3.com_ssl.conf:9:    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
/usr/local/nginx/conf/ssl/domain4.com_ssl.conf:9:    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

Not anymore.
Direct to OVH Server now.

 

That, I will observe now.

 

Just started using this config 4 days ago.

Not sure how much time as I already clean my log now to monitor again.

Cloudflare Full.

 

I still got this errors show up sometimes now.
Not using Cloudflare anymore since June 2021.

Dev SSL Lab Test