ACE: Problem with end-to-end SSL

Unanswered Question
Oct 4th, 2007
User Badges:
  • Silver, 250 points or more


I'm having a problem with configuring end-to-end SSL as documented in Section 5 of the ACE SSL guide.

Without the ssl-proxy definition it "works" in the sense that the response is HTTPS format from either of the real servers.

If I add

ssl-proxy server PSERVICE_SERVER into

policy-map multi-match LB-VIP

class VIP-CATHY-https

loadbalance vip inservice

loadbalance policy VIP-LB-CATHY-https

then it fails and a wireshark trace shows a Handshake Failure - but no helpful details.

What I'm trying to do is terminate and re-initiate the SSL traffic to the two real servers.

Am I missing something obvious? The configuration of my Test context is attached.

Kind Regards


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
ciscocsoc Wed, 10/10/2007 - 22:28
User Badges:
  • Silver, 250 points or more

Thank you.

I don't have access to the bug database - so if you could copy it to here that would be helpful.

I think I've got a config that works. I hadn't grasped the necessity for a layer 7 policy to make it work. Also I needed to set the close-protocol in the SSL parameters to be none rather than strict (default).

Kind Regards


Gilles Dufour Thu, 10/11/2007 - 01:29
User Badges:
  • Cisco Employee,

Cathy, are you using IE ??

If yes, could you try another brother like mozilla.

Are you using certificate group ?

Is the total size bigger than 4k ?


ciscocsoc Thu, 10/11/2007 - 03:25
User Badges:
  • Silver, 250 points or more

I was using IE. By chance I saw another query on here that mentioned the close-protocol option.

I don't think the chaingroup exceeded 4K - but it was probably borderline. I took out the server certificate and just left in the 3 GlobalSign certificates. I couldn't see the point of including it in the chain as well as in the server definition.

I think I have it working - it was just a lot more complicated than I thought it would be. It would be useful if the manual had an example of an end-to-end configuration rather than just referring to Ch4 and Ch3.

Thank you for your help.

Kind Regards



This Discussion