Handshake failure when requesting nginx server in https protocol - ssl

Question

I'm confronted problem with the https request. The problem is that I'm configuring nginx server to accept https request from applications on windows computers but failed to connect to server. The following are some information on wireshark:
Windows application request:
Response from server1:
Yet another server2 response:
The nginx version on server is 1.12.2 and openssl version is 1.0.1f . Nginx configurations is as below:
ssl_certificate /etc/nginx/cert/cert.pem;
ssl_certificate_key /etc/nginx/cert/cert.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
Information about server1 from https://www.ssllabs.com/ssltest/analyze.html:
Since I counld not find any client's cipher suites like "TLS_RSA_WITH_3DES_EDE_CBC_SHA" in server TLSv1.0 . I wonder if it's the difference between languages or softwares that makes the problem happen.
by the way, I have no more information other than request url about server2 and my goal is to deploy server1 to accept requests from windows clients.
Could any one give some advice to solve the problem or provide some clues? thanks very much!

Answer 1

I finally found out the reason for the problem. The problem occurred because nginx 1.12.2 does not support week ssl ciphers by default. And the client applicatioin which is built on different version of windows OS like XP provides limited cipher suites such as TLS_RSA_WITH_3DES_EDE_CBC_SHA and TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA. These cipher suites are weak in security. The same problem occurred in IE8 browser. IE8 sometime is not able to visit newer websites.
My solution is to recompile nginx with some extra parameters:
install dependency
sudo apt-get install build-essential libpcre3 libpcre3-dev zlib1g-dev unzip git
download nginx
wget -c https://nginx.org/download/nginx-1.12.2.tar.gz
tar zxf nginx-1.12.2.tar.gz
check openssl version
dpkg -s openssl
check openssl support for 3DES
openssl ciphers -v "3DES"
download openssl source code openssl >=1.1.0 don't support 3DES by default
wget -O openssl.zip -c https://github.com/openssl/openssl/archive/OpenSSL_1_0_1f.zip
unzip openssl.zip
mv openssl-OpenSSL_1_0_1f/ openssl
compile and install nginx
cd nginx-1.12.2
./configure --with-openssl=../openssl --with-http_ssl_module --with-openssl-opt='enable-weak-ssl-ciphers'
make
sudo make install
With some ssl configuration, the server is able to support https request with 3DES cipher suites.
Thanks!