Hello,

The trace log is uploaded at
https://gist.github.com/sigv/58a5d148579c75d39b2b7c76a3254fa5

We are running 2.9-dev8 for the server connection close fix for
"not-so-great" gRPC clients. We just experienced an ha_panic seemingly
triggered from OpenSSL 3. This is a fairly default Ubuntu 22.04
system, with locally built HAProxy package (as there are no "official"
dev builds).

Our SSL/TLS configuration is fairly basic too. I do not think it
contributes to the issue on hand. On bind we have `strict-sni`, a
`crt-list` specified and `alpn h2,http/1.1`.

ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
ssl-default-bind-ciphers
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites
TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

In our log, we have some "SSL handshake failure" lines and some more
detailed "SSL handshake failure (error:0A00010B:SSL routines::wrong
version number)" lines. I presume these are not related -- instead
being caused by some clients potentially connecting to port 443 and
trying to talk plaintext, or wanting to run TLS 1.1 or older.

Let me know if I can provide any more insights.

Best regards
Valters Jansons

Reply via email to