1

I'm using haproxy 1.8.17 and openssl 1.1.1a from Debian testing to serve TLS 1.2 connections with client authentication.

In wireshark I observe the usual TLS messages:

  • client->server: Client Hello
  • server->client: Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
  • client->server: Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message

Now HAProxy answers with: Alert (Level: Fatal, Description: Decrypt Error)

So my question is: what can cause this type of error?

Improve this question
1
  • RFC5246: "A handshake cryptographic operation failed, including being unable to correctly verify a signature or validate a Finished message. This message is always fatal." Commented Jan 22, 2019 at 10:33

1 Answer 1

Reset to default
0

In this case the cause of the error is very simple: I've used the wrong CA cert in the haproxy config.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.