5 minute read | Content level: Intermediate<\/p>\n\n\n\n
AWS re:Post – Why do SSL\/TLS negotiation errors occur when connecting to an Application Load Balancer over HTTPS, and how can I identify the responsible client IP?<\/a><\/p>\n\n\n\n I want to identify the client IP for SSL\/TLS negotiation errors when connecting to an Application Load Balancer (ALB) using HTTPS.<\/p>\n\n\n\n A client TLS negotiation error occurs when a client-initiated TLS connection fails to establish a session with the load balancer. When this error occurs, the ClientTLSNegotiationErrorCount<\/strong> metric on the ALB increases.<\/p>\n\n\n\n If ALB connection logging is enabled and the load balancer fails to establish a connection with the client, the failure reason is recorded in the tls_verify_status<\/strong> field of the logs. Additionally, certain special values in tls_verify_status require further interpretation:<\/p>\n\n\n\n ** Note: Load balancer logs requests on a best-effort basis<\/strong>. We recommend using ALB logs to understand the nature of the requests, not as a complete accounting of all requests.<\/p>\n\n\n\n Each TLS security policy supports a specific set of protocols and ciphers. If the client’s request does not conform to these supported configurations, an SSL\/TLS negotiation error may occur. TLS 1.3 TLS_AES_128_GCM_SHA256 To diagnose the issue, compare the protocol and cipher used by the client with the protocols and ciphers allowed by the ALB listener’s security policy. For precise troubleshooting, capturing client-side packets is the most effective way to determine why TLS negotiation failed and which client IP was affected. Replace with your ALB’s domain name to test TLS 1.2 support.<\/p>\n\n\n\n You can enable VPC Flow logs on the ENI(Elastic Network Interface) of your ALB nodes and compare them with ALB Access logs.<\/p>\n\n\n\n When a client successfully establishes a connection, the conn_trace_id<\/strong> field links the Connection logs with the Access logs.<\/p>\n\n\n\n By following these steps, you can determine the cause of SSL\/TLS negotiation errors and identify affected client IPs effectively.<\/p>\n\n\n\n [1] CloudWatch metrics for your Application Load Balancer – Application Load Balancer metrics<\/a> <\/p>","protected":false},"excerpt":{"rendered":" I want to identify the client IP for SSL\/TLS negotiation errors when connecting to an Application Load Balancer (ALB) using HTTPS.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[186],"tags":[209,187,211,208,213,207],"class_list":["post-5081","post","type-post","status-publish","format-standard","hentry","category-aws","tag-alb","tag-aws","tag-client-ip","tag-clienttlsnegotiationerrorcount","tag-mar-12-2025","tag-repost"],"_links":{"self":[{"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/posts\/5081"}],"collection":[{"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/comments?post=5081"}],"version-history":[{"count":4,"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/posts\/5081\/revisions"}],"predecessor-version":[{"id":5634,"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/posts\/5081\/revisions\/5634"}],"wp:attachment":[{"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/media?parent=5081"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/categories?post=5081"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/saraheee.com\/ko\/wp-json\/wp\/v2\/tags?post=5081"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\n\n\nShort description<\/h2>\n\n\n\n
This error can occur under the following conditions:<\/p>\n\n\n\n\n
Summary<\/h2>\n\n\n\n
\n
\n
\n
Resolution<\/h2>\n\n\n\n
1. Check ALB Connection Logs<\/h3>\n\n\n\n
1) Error codes in tls_verify_status<\/h4>\n\n\n\n
The following error codes indicate possible causes of SSL\/TLS negotiation failures:<\/p>\n\n\n\n\n
\n
2) Compare TLS Security Policy and supported Protocols\/Ciphers<\/h4>\n\n\n\n
By default, ELBSecurityPolicy-TLS13-1-2-2021-06<\/strong> is assigned to listeners created via the AWS Management Console.
This policy supports the following:<\/p>\n\n\n\nSupported Protocols: <\/h5>\n\n\n\n
\n
TLS 1.2<\/p>\n<\/blockquote>\n\n\n\nSupported Ciphers: <\/h5>\n\n\n\n
\n
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384<\/p>\n<\/blockquote>\n\n\n\n
If they do not match, the ClientTLSNegotiationErrorCount<\/strong> metric will increase.<\/p>\n\n\n\n2. Capture client-side Packet data<\/h3>\n\n\n\n
Packet capture tools such as tcpdump<\/strong> or Wireshark<\/strong> can help identify the exact cipher<\/strong> and protocol<\/strong> used in the negotiation process.
You can also use OpenSSL<\/strong> to manually check which ciphers and protocols are supported by the server:<\/p>\n\n\n\n$ openssl s_client -connect <ALB-Domain>:443 -tls1_2<\/code><\/pre>\n\n\n\n3. Compare other logs<\/h3>\n\n\n\n
1) Compare VPC Flow logs and ALB Access logs<\/h4>\n\n\n\n
\n
2) Compare ALB Connection logs and ALB Access logs<\/h4>\n\n\n\n
\n
Conclusion & Recommendations<\/h2>\n\n\n\n
\n
Related Information<\/h2>\n\n\n\n
[2] Connection logs for your Application Load Balancer – Error reason codes<\/a>
[3] Security policies for your Application Load Balancer<\/a>
[4] re:Post – How do I identify and resolve client connection issues when I use mTLS with the Application Load Balancer?<\/a>
[5] re:Post – How do I troubleshoot client SSL\/TLS negotiation errors when I connect to an Application Load Balancer that uses HTTPS?<\/a>
[6] re:Post – Why do I get a client SSL\/TLS negotiation error when I try to connect to my load balancer?<\/a><\/p>\n\n\n\n