SSL: UNKNOWN_PROTOCOL with Google Cloud's SSL Load Balancing Proxy

Question

I have a simple python SSL server behind a GCP SSL Proxy Load Balancer (https://cloud.google.com/load-balancing/docs/ssl/) set up as per the documentation (https://cloud.google.com/load-balancing/docs/ssl/setting-up-ssl/) with the exception that the server runs on a single node in an instance group of one. The GCP SSL proxy can connect to the server as I see a lot of empty health check requests that the server prints. DNS for the node name mypocketxp.com points to the static IP I attached to the proxy's forwarding rule. When I connect with the client below or with 'openssl s_client -connect mypocketxp.com:443' the server crashes with

Traceback (most recent call last):
  File "./server3.py", line 13, in 
    sslsoc = context.wrap_socket(newsocket, server_side=True)
  File "/usr/lib64/python3.6/ssl.py", line 365, in wrap_socket
    _context=self, _session=session)
  File "/usr/lib64/python3.6/ssl.py", line 776, in __init__
    self.do_handshake()
  File "/usr/lib64/python3.6/ssl.py", line 1036, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib64/python3.6/ssl.py", line 648, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:877)

When I remove the proxy from the equation, and change the DNS entry to point directly to the node running the server and replace the self-signed certificate and key with the certificate and key issued by a trusted CA for mypocketxp.com I can connect without a problem.

So it seems that the connection from the SSL Proxy to the server is causing the problem but I have no idea why.

Any help is appreciated. Thank you for looking into this

Server

#!/usr/bin/python3
import socket, ssl

context = ssl.SSLContext(ssl.PROTOCOL_TLS)
context.load_cert_chain(certfile="/home/adittmer/selfsigned.pem", keyfile="/home/adittmer/selfsigned.key")

bindsocket = socket.socket()
bindsocket.bind(('', 443))
bindsocket.listen(5)

while True:
    newsocket, fromaddr = bindsocket.accept()
    sslsoc = context.wrap_socket(newsocket, server_side=True)
    request = sslsoc.read()
    print(request)

Client

#!/usr/bin/python3

import socket
import ssl

server_name = 'mypocketxp.com'
server_port = 443

context = ssl.create_default_context()
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_verify_locations("/etc/ssl/certs/DST_Root_CA_X3.pem")
conn = context.wrap_socket(socket.socket(socket.AF_INET), server_hostname=server_name)
conn.connect((server_name, server_port))

conn.send(b"Hello, world!")
conn.close()

SSL: UNKNOWN_PROTOCOL with Google Cloud's SSL Load Balancing Proxy

0 Answers