Nginx container - SSL handshake failure logs

shameera91

I noticed a large number of SSL handshake failure logs in the nginx container.

2025/02/12 04:34:39 [crit] 14#14: *12271 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 83.121.200.57, server: 0.0.0.0:443
2025/02/12 04:34:39 [crit] 14#14: *12272 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 5.238.190.97, server: 0.0.0.0:443
2025/02/12 04:34:39 [crit] 14#14: *12273 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 93.110.180.109, server: 0.0.0.0:443
2025/02/12 04:34:39 [crit] 14#14: *12274 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 5.146.251.56, server: 0.0.0.0:443
2025/02/12 04:34:39 [crit] 14#14: *12279 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 83.121.200.57, server: 0.0.0.0:443
2025/02/12 04:34:39 [crit] 15#15: *12284 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 5.239.95.111, server: 0.0.0.0:443
2025/02/12 04:34:40 [crit] 15#15: *12289 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 91.107.148.56, server: 0.0.0.0:443
2025/02/12 04:34:40 [crit] 15#15: *12295 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 5.239.95.111, server: 0.0.0.0:443
2025/02/12 04:34:40 [crit] 13#13: *12298 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 93.110.180.109, server: 0.0.0.0:443
2025/02/12 04:34:40 [crit] 13#13: *12300 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 91.106.78.193, server: 0.0.0.0:443
2025/02/12 04:34:40 [crit] 13#13: *12306 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking, client: 83.121.200.57, server: 0.0.0.0:443

What could be the reason for this ?

DocFraggle

shameera91 Are you using a reverse proxy? If yes, check your config and if you’re using HTTP or HTTPS correctly in your config

ETNyx

Hello, hard to say, this can be many things i would guess:
1) You made some bad configuration decision on your server.
2) Malformed traffic (usually bots and scanners).
2) Client used unsupported encryption.
3) Message is expected to be encrypted, but it’s not (e.g. what should be run over port 80 is send on 443).
4) Men in the middle attack.

shameera91

@ETNyx I suspect this is might be malformed traffic or some kind of a attack. will check further.

@DocFraggle Not using reverse proxy

MK796

I have similar problems since weeks!
But in my case the postfix logs are full of such logs.

This amongst that someone tries to guess smtp users and their passwords I would guess that this are attacks…