nginx timeout_error ai_generated true

SSL handshake timeout while connecting to upstream

ID: nginx/ssl-handshake-timeout-upstream

Also available as: JSON · Markdown · 中文
80%Fix Rate
85%Confidence
1Evidence
2024-03-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx 1.18.0 active — — —
nginx 1.20.2 active — — —
nginx 1.22.1 active — — —

Root Cause

Upstream server is slow to complete the SSL handshake, often due to high load or network latency.

generic

中文

上游服务器完成SSL握手过程缓慢，通常由高负载或网络延迟引起。

Official Documentation

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_handshake_timeout

Workarounds

  1. 85% success Increase proxy_ssl_handshake_timeout in the location block: proxy_ssl_handshake_timeout 30s; 
    Increase proxy_ssl_handshake_timeout in the location block:
proxy_ssl_handshake_timeout 30s;
  2. 75% success Optimize upstream SSL configuration: enable session caching and reduce cipher negotiation overhead: proxy_ssl_session_reuse on; proxy_ssl_ciphers HIGH:!aNULL:!MD5; 
    Optimize upstream SSL configuration: enable session caching and reduce cipher negotiation overhead:
proxy_ssl_session_reuse on;
proxy_ssl_ciphers HIGH:!aNULL:!MD5;

中文步骤

  1. 在location块中增加proxy_ssl_handshake_timeout：
proxy_ssl_handshake_timeout 30s;
  2. 优化上游SSL配置：启用会话缓存并减少密码协商开销：
proxy_ssl_session_reuse on;
proxy_ssl_ciphers HIGH:!aNULL:!MD5;

Dead Ends

Common approaches that don't work:

  1. Increase proxy_read_timeout 90% fail

    proxy_read_timeout controls reading response body, not SSL handshake timeout.

  2. Disable SSL verification entirely 60% fail

    This removes security without addressing the root cause (slow handshake).

  3. Restart nginx service 95% fail

    Restarting nginx does not affect upstream SSL handshake speed.