SSL_do_handshake() failed

Sasidhara M

Hello,

I am getting this error during accessing WorkShop web application. I used NGINX as reverse proxy. Environment is Linux, Exstream 16.6.3 build 461

2021/11/17 00:25:21 [error] 117719#0: *142 SSL_do_handshake() failed (SSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol) while SSL handshaking to upstream, client: <client ip>, server: , request: "GET /management/rest/v1/servicegateways?where_tenant=tenant_SBX&where_applicationdomain=TestDomain&where_primary_access_node=true HTTP/1.1", upstream: "https://<mgwhost>:28801/management/rest/v1/servicegateways?where_tenant=tenant_SBX&where_applicationdomain=TestDomain&where_primary_access_node=true", host: "<mgwhost>:9443", referrer: "https://<mgwhost>:9443/workshop/"

2021/11/17 00:25:22 [notice] 117811#0: signal process started

2021/11/17 00:25:33 [error] 117812#0: *149 open() "/exstream/sbx/root/revproxy/html/workshop/moment.min.js.map" failed (2: No such file or directory), client: <client ip>, server: , request: "GET /workshop/moment.min.js.map HTTP/1.1", host: "<mgwhost>:9443"

Thank you,

Sasi.

Sasidhara M

I am still getting this error..

Any idea of this error? I installed certificate using bootstrap setup. This installed bootstrap.crt and bootstrap.key in NGINX root/revproxy/conf and bootstrap.cert under /<installdir>/global/security/certificatestore/trusted/authorities

{

 "bootstrap": {

  "operatingsystem": "linux",

  "BOOTSTRAPDIR": "/exstream/sbx/Bootstrap-16.6.3",

  "jre_home": "/exstream/sbx/jdk-11",

  "multitenantconfig": "multitenantconfig.json",

  "installuser": "strs",

  "installgroup": "sapsys",

  "strs": {

   "STRSZIP": "/exstream/sbx/exstream-16.6.3.ga.461-x86_64-suse-linux-release.tar.gz",

   "SAPZIP": "",

   "STRSBUILD": "Exstream-16.6.3.GA.461",

   "STRSINSTALLDIR": "/exstream/sbx",

   "STRSVERSION": "16.6",

   "STRSFILEVERSION": "16.6.3",

   "mgw": {

    "mgwhost": "localhost",

    "virtualhost": "<mgwhost>",

    "reverseproxyhost": "<mgwhost>",

    "reverseproxyport": 9443,

    "localproxy": true,

    "mgwport": 28800,

    "mgwroot": "/exstream/sbx/root",

    "mgwcert": "bootstrap",

    "mgwtimeout": 300000,

    "managementrestport": 28801,

    "distributednotificationsport": 28802

   },

   "keystore": {

    "keystorefile": "#BOOTSTRAPDIR/config/web/bootstrap.keystore",

    "keystoretype": "JKS",

    "keyalias": "bootstrap",

    "keystorepass": "HejaGais",

    "keypass": "HejaGais",

    "dname": "CN=#VIRTUALHOST,OU=CCEdemo,O=CCEdemo,L=CCedemo,S=CCedemo,C=SE",

    "subjectaltnames": "dns:#VIRTUALHOST,dns:localhost",

    "installtrust": false

   }

  },

  "bootstrapsteps": [

   {

    "step": "installdb",

    "config": "mssql.json",

    "description": "Installs local MSSQL database software",

    "enabled": "no",

    "status": ""

   },

   {

    "step": "installpostgres",

    "config": "postgres.ux.json",

    "description": "Installs local PostgreSQL database software",

    "enabled": "no",

    "status": ""

   },

   {

    "step": "installstrs",

    "config": "bootstrap.json",

    "description": "Installs local CCM 16 SW",

    "enabled": "no",

    "status": ""

   },

   {

    "step": "installcert",

    "description": "Creates and/or installs web certificate",

    "config": "bootstrap.json",

    "enabled": "yes",

    "status": ""

   },

+++++++

others

+++++++

]

}

}

NGINX port 9443

default.pl:

include proxy.conf;

## Load template engine utilities

#execute('systemutils.tpl')

#foreach($domain in $domains)

upstream backend_sgw_rest_$domain['tenant_domain_name'] {

  sticky name=sticky_$domain['tenant_domain_name'] httponly;

#foreach($sgw in $domain['service_gateways'])

#if ($sgw.running)

  server $sgw.node.host:$sgw.restPort; # $sgw.name

#end

#end

}

#end

#upstream backend_tomcat {

#  server localhost:443;

#}

 

#foreach($tenant in $system.tenants)

upstream backend_otds_$tenant.name {

  server $tenant.otdsHost:$tenant.otdsPort;

}

#end

upstream backend_mgw_http {

#foreach($node in $system.nodes)

  server $node.host:$node.soapPort;

#end

}

upstream backend_mgw_rest {

#foreach($node in $system.nodes)

  server $node.host:$node.restPort;

#end

}

server {

  # Simple reverse-proxy

  listen    9443 ssl;

  sendfile    on;

  # Set to unlimited upload file size

  client_max_body_size 0;

  # Logs

  access_log  logs/access.log;

 

  # SSL settings

  ssl_certificate   bootstrap.crt;

  ssl_certificate_key bootstrap.key;

  ssl_protocols    TLSv1.2;

#TLSv1 TLSv1.1 

# Hide the default anti-clickjacking security header 

proxy_hide_header X-Frame-Options;

proxy_hide_header Content-Security-Policy;

 

  # Backend locations

  

  # For OTDS filter redirect url to be correct the Host header must be set to \$http_host

  proxy_set_header Host \$http_host;

   

  # Custom headers so that backend can determine that the request is coming through a proxy and can handle OTDS login redirect

  proxy_set_header XX-ProxyHost \$scheme://\$http_host;

  proxy_set_header XX-ProxyPort \$server_port;

  # Nginx fail-over parameters

  proxy_redirect off;

  proxy_next_upstream error timeout invalid_header http_500;

  proxy_connect_timeout 1;

  proxy_set_header X-Real-IP \$remote_addr;

  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

  # MGW REST locations, rewrites incomming url by removing inital /mgw path

  location ~ ^/(management/rest/v1/servicegateways|mgw/|systeminfo|v1/applications|authenticate|applications|resources|v1/resources|security|v1/applicationdomains|applicationdomains|commitlabel|nodes|tenants|subscriptions) {

   rewrite ^/mgw(.*)$ $1 break; # Clients can add mgw/ first to the url to force the request to the MGW, needed for example when SGW:s and MGW hosts the same api:s

      proxy_pass      https://backend_mgw_rest;

  }

   

  # SGW REST locations per domain *authenticate does not rewrite url since it's needed for OTDS redirect, other url's removes intial tenant/domain path.

#foreach($domain in $domains)

#set($name = $domain['tenant_name'] + '/' + $domain['domain_name'])

  location ~ ^/($name/authenticate) {

      proxy_pass      https://backend_sgw_rest_$domain['tenant_domain_name'];

  }

  location ~ ^/($name/) {

   rewrite ^/${name}(.*)$ $1 break;

      proxy_pass      https://backend_sgw_rest_$domain['tenant_domain_name'];

  }

#end

    

  # OTDS locations

  # Note that the url needs to match any tenant url used with the otds server, or possibly a regexp could be used.

  # For example: location /otdstenant/cce/otdsws

#foreach($tenant in $system.tenants)

  location ~ /$tenant.name/(otdsws|otdstenant) {

 rewrite ^/${tenant.name}(.*)$ $1 break;

      proxy_pass      https://backend_otds_$tenant.name;

  }

#end

 

  # Webapps locations

location ~ ^/(favicon.ico|workshop/|storyboard/|supervisor/|retouch/|ruleeditor/|writer/|casbrowser/|devicepreview/|control/|config/|exstream/|orchestrator/) {

   # Set app cookies to point to the reverse proxy URL.

   add_header Set-Cookie "RULEEDITOR_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   add_header Set-Cookie "SUPERVISOR_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   add_header Set-Cookie "WORKSHOP_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   add_header Set-Cookie "RETOUCH_HOST_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   add_header Set-Cookie "DDE_HOST_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   add_header Set-Cookie "BCAEDITOR_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   add_header Set-Cookie "TEXTEDITOR_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

  add_header Set-Cookie "ORCHESTRATOR_URL=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

 

   # add_header Set-Cookie "URL_MAPPINGS=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

   # add_header Set-Cookie "CUSTOM_APP_URLS=;path=/; expires=Thu, Jan 01 1970 00:00:00 UTC;";

 

      add_header Set-Cookie "RULEEDITOR_URL=https://\$http_host/ruleeditor/;Path=/";

      add_header Set-Cookie "SUPERVISOR_URL=https://\$http_host/supervisor/;Path=/";

      add_header Set-Cookie "WORKSHOP_URL=https://\$http_host/workshop/;Path=/";

      add_header Set-Cookie "RETOUCH_HOST_URL=https://\$http_host/retouch/;Path=/";

      add_header Set-Cookie "DDE_HOST_URL=https://\$http_host/storyboard/;Path=/";

      add_header Set-Cookie "BCAEDITOR_URL=https://\$http_host/exstream/;Path=/";

      add_header Set-Cookie "TEXTEDITOR_URL=https://\$http_host/writer/;Path=/";

    add_header Set-Cookie "ORCHESTRATOR_URL=https://\$http_host/orchestrator/;Path=/";

    

  # Friendly URLs; To enable friendly URLs, please uncomment the following line and make changes accordingly

  # add_header Set-Cookie "URL_MAPPINGS=t1:cce|Testdomain::t2:cce|Testdomain;Path=/";

add_header Set-Cookie "URL_MAPPINGS=t1:tenant_SBX|TestDomain;Path=/";

  # Custom App URLs; To enable Custom App URLs, please uncomment the following line and make changes accordingly

    # add_header Set-Cookie "CUSTOM_APP_URLS=123:CASBrowser|https://\$http_host/casbrowser;Path=/";

  

   # Cookies are set, forward to upstream tomcat

      #proxy_pass      https://backend_tomcat;

  }

  # MGW SOAP locations

  location ~ ^/(management) {

      proxy_pass      https://backend_mgw_http;

  }

  location / {

      proxy_pass      https://backend_mgw_http;

  }

}