Hi all,
I’m experiencing a weird SSL/TLS handshake failure issue when using Cloudflare as a reverse proxy for my WebSockets server.
I’ve got websocat/laravel-websockets services running on AWS EC2 behind AWS Elastic Load Balancing, which helps handle SSL/TLS. After adding the ELB to Cloudflare with reverse proxy turned on, the entire traffic flow looks like:
client -(WebSockets)-> Cloudflare -(WebSockets)-> AWS ELB -(WebSocket)-> EC2
project.example.com:8443 project.elb.amazonaws.com:8443 X.X.X.X
Everything worked smoothly until I I tried to change project.example.com to ws.project.example.com and it started throwing SSL handshake failures.
$ websocat wss://ws.project.example.com
websocat: WebSocketError: TLS failure
websocat: error running
$ curl -lk https://project.example.com:8443
Only WebSocket connections are welcome here
$ curl -lkv https://ws.project.example.com:8443
* Rebuilt URL to: https://ws.project.example.com:8443/
* Trying 104.27.X.X...
* TCP_NODELAY set
* Connected to ws.project.example.com (104.27.X.X) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS alert, Server hello (2):
* error:14004410:SSL routines:CONNECT_CR_SRVR_HELLO:sslv3 alert handshake failure
* stopped the pause stream!
* Closing connection 0
curl: (35) error:14004410:SSL routines:CONNECT_CR_SRVR_HELLO:sslv3 alert handshake failure
I’m using ‘Full’ SSL setting in Cloudflare so the certificate in ELB shouldn’t be a problem (it’s issued to project.example.com FYI) and actually I can have whatever.example.com pointed to project.elb.amazonaws.com in Cloudflare to make WebSockets work without any hiccups. However, whenever I switch to a 4th level domain, i.e. foo.project.example.com, it starts to give me handshake failures.
To make things even weirder, I can actually tweak WebSocket proxy to work by adding a page rule:
ws.project.example.com:8080/* SSL: Off
and forward project.elb.amazonaws.com:8080 to my EC2 as well.
I wonder whether there’s some sort of limitation in Cloudflare which restricts WebSockets proxy to 3rd (and 2nd?) level domains?
Please help. Thanks.