On PAM environment were fixing issues with SSL certificate. We stopped the cluster and uploaded this year certificates into the node. After the certificated are activated 2 of the node connectivity is failing.
Out of 3 servers xxx.xxx.com is working able to connect. Start and stop of cluster is working.
xxx.xxx.com not able to connect.
PAM Client is gives below error.
Curl to these machine fail with below error.
# curl -vvv 'https://xxx.xxx.com'
* Rebuilt URL to: https://xxx.xxx.com/
* Trying 10.0.0.10...
* TCP_NODELAY set
* Failed to set TCP_KEEPALIVE on fd 4
* Connected to xxx.xxx.com (x.x.x.x) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
CAfile: none
CApath: /etc/openssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Unknown (21):
* TLSv1.2 (IN), TLS alert, Server hello (2):
* error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
openssl also failing.
openssl s_client -connect xxx.xxx.com:443
CONNECTED(00000004)
2249710069462008:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:802:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 295 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1665578692
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
Release : 4.1.x
Client had installed an RSA signed certificate but deselected the 2 RSA ciphers in the configuration
After adding the certificate, the client confirmed the appropriate options were selected