For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

getrajan1's avatar
getrajan1
Icon for Nimbostratus rankNimbostratus
Dec 21, 2025

TLS handshake failure from BIG-IP to backend – Fatal Alert: Decode Error (Server SSL)

 

Hello DevCentral Team,

I am troubleshooting a server-side TLS issue where BIG-IP intermittently fails to establish a TLS connection to a backend service.

Observed behavior:
Client to BIG-IP TLS handshake completes successfully.
BIG-IP to backend TLS handshake fails.
Backend responds with a TLS alert: Level Fatal, Description Decode Error.
Failure occurs very early in the handshake, immediately after ClientHello.

Configuration details (sanitized):
Backend service listens on HTTPS using TLS 1.2.
BIG-IP is operating in full-proxy mode.
The default serverssl profile has been removed.
A custom Server SSL profile is attached with an explicit server-name configured and server-side SNI enabled.
No client certificate authentication is required by the backend.

Validation already performed:
Direct openssl s_client testing from BIG-IP to the backend succeeds.
TLS version and cipher suites are compatible.
Backend certificate chain appears valid when tested outside BIG-IP.
The issue appears specific to BIG-IP initiated server-side TLS.

Questions:
Can a backend return a fatal decode_error even when BIG-IP sends SNI correctly?
Are there known cases where certain TLS extensions sent by BIG-IP but not by OpenSSL trigger this error?
Are there Server SSL settings commonly associated with decode_error responses?
Any recommended BIG-IP specific debugging steps beyond tcpdump and ssldump?

Thanks in advance for any guidance or similar experiences.

2 Replies

  • I don't think it's an SNI error to be honest.

    I'd make sure the client and server both use same TLS version.
    also for debug purposes I suggest to use the default serverssl profile in the big-ip.
    in the TCPDUMP just look at the TLS version and cipher suites.

  • First, check whether server-side communication is working by using the curl command on the F5 device.
    Also, since the TLS version may differ, allow all ciphers via the cipher group and perform a test.