"peer closed connection in SSL handshake" on cloud flare SSL handshake failed - ssl

Question

Recently I am getting "SSL handshake failed" error on my Cloudflare websites.
When I looked at my nginx log I found the following errors:
2021/05/23 02:35:52 [info] 10528#0: *124920510 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.147, server: 0.0.0.0:443
2021/05/23 02:42:57 [info] 10528#0: *124925310 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.147, server: 0.0.0.0:443
2021/05/23 02:50:19 [info] 11633#0: *124929231 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.165, server: 0.0.0.0:443
2021/05/23 02:50:27 [info] 11632#0: *124929281 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.165, server: 0.0.0.0:443
2021/05/23 02:54:18 [info] 11633#0: *124930616 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.161, server: 0.0.0.0:443
Everytime SSL Handshake error occurs, "peer closed connection in SSL handshake" line gets added in the log.
Can you please tell me how can I fix this issue?
Nginx config
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name mydomain.in;
set $base /home/username/websites/mydomain.in;
root $base/;
# SSL
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_certificate /etc/letsencrypt/live/mydomain.in/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.in/privkey.pem;
# logging
access_log /home/username/nginx/logs/mydomain.in.access.log;
error_log /home/username/nginx/logs/mydomain.in.error.log debug;
# index.php
index index.php;
# index.php fallback
location / {
try_files $uri $uri/ /index.php?$query_string;
}
# handle .php
location ~ \.php$ {
include nginxconfig.io/php7.4_fastcgi.conf;
}
#include nginxconfig.io/general.conf;
# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline' worker-src blob:" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# . files
location ~ /\.(?!well-known) {
deny all;
}
# favicon.ico
location = /favicon.ico {
log_not_found off;
access_log off;
}
# robots.txt
location = /robots.txt {
log_not_found off;
access_log off;
}
# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
expires 7d;
access_log off;
}
# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
add_header Access-Control-Allow-Origin "*";
expires 7d;
access_log off;
}
# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;
}
Server Ubuntu 18.04
Nginx 1.16

Answer 1

No information can be extracted just based on the provided information on why these specific clients abandoned the TLS handshake. It might be some tests, it might be something else.
If these are normal browsers than a common cause is that the certificate provided by the server can not be verified by the client. This might for example happen with self-signed certificates, certificates issued by a non-public CA, missing intermediate certificates, mismatch of hostname ...
Given that these IP seem to belong to Cloudflare it might still be the a messed up setup of the certificates - simply giving the filenames without the actual content will not help though.
But again, just based on the provided log entries and config one can only do educated guesses and speculations.