SSL_do_handshake failed on verified certificate chain

[Wolfgang]

Hi Folks,

after a fresh install I can't connect to nginx running on port 4200.

root@mailserv:/var/log # cat httpd.err

2012/10/31 18:50:33 [alert] 29516#0: worker process 13892 exited on signal 10

2012/10/31 18:50:33 [alert] 29516#0: worker process 32143 exited on signal 10

2012/10/31 18:50:40 [alert] 29516#0: worker process 4363 exited on signal 10

2012/10/31 18:50:40 [alert] 29516#0: worker process 30612 exited on signal 10

2012/10/31 18:50:49 [alert] 29516#0: worker process 21239 exited on signal 10

2012/10/31 18:50:49 [alert] 29516#0: worker process 17699 exited on signal 10

2012/10/31 18:50:52 [alert] 29516#0: worker process 21313 exited on signal 10

2012/10/31 18:50:52 [alert] 29516#0: worker process 11986 exited on signal 10

2012/10/31 18:50:53 [alert] 29516#0: worker process 12196 exited on signal 10

2012/10/31 18:50:53 [alert] 29516#0: worker process 28314 exited on signal 10

2012/10/31 18:50:54 [alert] 29516#0: worker process 16105 exited on signal 10

2012/10/31 18:50:54 [alert] 29516#0: worker process 1685 exited on signal 10

2012/10/31 18:51:26 [alert] 29516#0: worker process 12031 exited on signal 10

2012/10/31 18:51:27 [alert] 29516#0: worker process 24643 exited on signal 10

2012/10/31 18:51:30 [alert] 29516#0: worker process 3142 exited on signal 10

2012/10/31 18:51:35 [alert] 29516#0: worker process 19596 exited on signal 10

2012/10/31 19:02:31 [crit] 23097#0: *2 SSL_do_handshake() failed (SSL: error:260B9092:engine routines:ENGINE_get_cipher:unimplemented cipher error:0607B086:digital envelope routines:EVP_CipherInit_ex:initialization error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac) while SSL handshaking, client: 127.0.0.1, server:

2012/10/31 19:02:32 [alert] 16200#0: worker process 23097 exited on signal 11

Seems to be related to his one: http://trac.nginx.org/nginx/ticket/39

The fix is: http://mailman.nginx.org/pipermail/nginx-devel/2011-September/001226.html

Just add "ssl_engine aesni" in the main nginx config.

Took me a while to figure out...

Wolfgang