Forum Discussion
TLS handshake failure from BIG-IP to backend – Fatal Alert: Decode Error (Server SSL)
Hello DevCentral Team,
I am troubleshooting a server-side TLS issue where BIG-IP intermittently fails to establish a TLS connection to a backend service.
Observed behavior:
Client to BIG-IP TLS handshake completes successfully.
BIG-IP to backend TLS handshake fails.
Backend responds with a TLS alert: Level Fatal, Description Decode Error.
Failure occurs very early in the handshake, immediately after ClientHello.
Configuration details (sanitized):
Backend service listens on HTTPS using TLS 1.2.
BIG-IP is operating in full-proxy mode.
The default serverssl profile has been removed.
A custom Server SSL profile is attached with an explicit server-name configured and server-side SNI enabled.
No client certificate authentication is required by the backend.
Validation already performed:
Direct openssl s_client testing from BIG-IP to the backend succeeds.
TLS version and cipher suites are compatible.
Backend certificate chain appears valid when tested outside BIG-IP.
The issue appears specific to BIG-IP initiated server-side TLS.
Questions:
Can a backend return a fatal decode_error even when BIG-IP sends SNI correctly?
Are there known cases where certain TLS extensions sent by BIG-IP but not by OpenSSL trigger this error?
Are there Server SSL settings commonly associated with decode_error responses?
Any recommended BIG-IP specific debugging steps beyond tcpdump and ssldump?
Thanks in advance for any guidance or similar experiences.
2 Replies
- Shyy
Cirrus
I don't think it's an SNI error to be honest.
I'd make sure the client and server both use same TLS version.
also for debug purposes I suggest to use the default serverssl profile in the big-ip.
in the TCPDUMP just look at the TLS version and cipher suites. First, check whether server-side communication is working by using the curl command on the F5 device.
Also, since the TLS version may differ, allow all ciphers via the cipher group and perform a test.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com