# NGINX Reverse Proxy returning 552 after update to 8.1.33

**URL:** <https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053>\
**Category:** Ignition\
**Tags:** ignition81, perspective\
**Created:** [October 26, 2023, 9:37pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053 "2023-10-26T21:37:26Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 26, 2023, 9:37pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/1 "2023-10-26T21:37:26Z")

</div>

We have a ngix reverse proxy that we use to run a number of perspective sessions. Perspective sessions inside the network continue as normal.

Connection through the reverse proxy are closed, and looking at the packet capture the gateway sends the following response ' TLSv1.2 alert (level fatal description illegal parameter)'

I found references to a bugs in openSSL, but I don't think it's applicable or in use.

Is there anywhere on the gateway I can enable additional logging to capture what's causing the error or which cypher so I can disable it? The nginx proxy is managed by others, so I'm unable to review it's configuration.

Thanks

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 26, 2023, 9:42pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/2 "2023-10-26T21:42:48Z")

</div>

Hmm. No clues in the initial handshake from the capture?

You can add `-Djavax.net.debug=all` to the additional parameters section of `ignition.conf` and then restart the gateway. This will produce some _very_ verbose logging that goes only to the wrapper.log files, and might help in troubleshooting.

---

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 26, 2023, 9:45pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/3 "2023-10-26T21:45:37Z")

</div>

Currently I only have a screenshot of the capture, hopefully I'll get a copy shortly.

I'll give that a try!

Thanks for the suggestion!

---

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 27, 2023, 2:02am UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/4 "2023-10-27T02:02:30Z")

</div>

Thanks again Kevin.

Just as a warning to anyone else who enables debug, you may need to increase your file size maximum to capture the data you need.

During the TLS negotiation, connections traversing the reverse proxy are sending a null session id and failing with the error:  
javax.net.ssl|ALL|B3|webserver-59|2023-10-26 xx:xx:xx.xxx xxx|null:-1|Can't resume, the existing session is not rejoinable

Clients on the local network have a session id present in the ClientHello.

I'm unsure if this is a new behavior from nginx or if 8.1.33 modified how it handles null session ids.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 27, 2023, 3:02am UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/5 "2023-10-27T03:02:59Z")

</div>

8.1.33 upgraded Java from 11 to 17, I wouldn't be surprised if there are some subtle changes in TLS behavior.

Is the connection attempt being made with TLS 1.3? AFAIK it's not valid to send a null/empty session ID in that case.

---

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 27, 2023, 3:05am UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/6 "2023-10-27T03:05:04Z")

</div>

It's using TLS 1.2, the product we're using doesn't support TLS 1.3 sadly.

I'll have the team that manages the access reach out to their support.

Thanks for the help.

---

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 27, 2023, 1:53pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/7 "2023-10-27T13:53:13Z")

</div>

I missed read your reply last night, if the negotiation is using TLSv1.2, a null session ID on initial contact should be acceptable?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 27, 2023, 1:56pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/8 "2023-10-27T13:56:56Z")

</div>

I think so? I’m not sure if the log statement you posted above is actually the error that terminates the connection or if it’s informational, just stating the connection can’t be resumed.

Can you share the full logs and Wireshark capture in your support ticket, and not just a snippet and a screenshot?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 27, 2023, 3:43pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/9 "2023-10-27T15:43:41Z")

</div>

Alright, so I think I found your actual issue. The empty/null session id is not relevant.

Here's the real error:

```auto
| javax.net.ssl|ERROR|44|webserver-68|2023-10-26 18:44:00.218 CDT|null:-1|Fatal (ILLEGAL_PARAMETER): Illegal server name, type=host_name(0), name=redacted:8043, value={6361722D6F747369706730332E386176652D6F742E636F6D3A38303433} (
| "throwable" : {
| javax.net.ssl.SSLProtocolException: Illegal server name, type=host_name(0), name=redacted:8043, value={6361722D6F747369706730332E386176652D6F742E636F6D3A38303433}
| at java.base/sun.security.ssl.ServerNameExtension$CHServerNamesSpec.<init>(Unknown Source)
| at java.base/sun.security.ssl.ServerNameExtension$CHServerNamesStringizer.toString(Unknown Source)
| at java.base/sun.security.ssl.SSLExtension.toString(Unknown Source)
| at java.base/sun.security.ssl.SSLExtensions.toString(Unknown Source)
| at java.base/sun.security.ssl.ClientHello$ClientHelloMessage.toString(Unknown Source)
| at java.base/sun.security.ssl.SSLLogger$SSLSimpleFormatter.formatObject(Unknown Source)
| at java.base/sun.security.ssl.SSLLogger$SSLSimpleFormatter.formatParameters(Unknown Source)
| at java.base/sun.security.ssl.SSLLogger.log(Unknown Source)
| at java.base/sun.security.ssl.SSLLogger.fine(Unknown Source)
| at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.consume(Unknown Source)
| at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
| at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
| at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(Unknown Source)
| at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(Unknown Source)
| at java.base/java.security.AccessController.doPrivileged(Unknown Source)
| at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(Unknown Source)
| at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:657)
| at org.eclipse.jetty.server.HttpConnection.fillRequestBuffer(HttpConnection.java:368)
| at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:265)
| at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
| at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
| at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:558)
| at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:379)
| at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:146)
| at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
| at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
| at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:416)
| at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:385)
| at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:272)
| at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:140)
| at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)
| at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)
| at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)
| at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)
| at java.base/java.lang.Thread.run(Unknown Source)
| Caused by: java.lang.IllegalArgumentException: The encoded server name value is invalid
| at java.base/javax.net.ssl.SNIHostName.<init>(Unknown Source)
| ... 35 more
| Caused by: java.lang.IllegalArgumentException: Contains non-LDH ASCII characters
| at java.base/java.net.IDN.toASCIIInternal(Unknown Source)
| at java.base/java.net.IDN.toASCII(Unknown Source)
| ... 36 more}
| 
| )

```

There seems to be some issue with the hostname (`redacted:8043`) or the way it's encoded... I'm not sure yet, but some validation step in the Java TLS implementation is rejecting it.

edit: oh, duh, it's a _hostname_, i.e. it should not include the port at the end `:8043`, and `:` is the "non-LDH" character it's probably complaining about (letters-digits-hyphen).

---

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 27, 2023, 3:51pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/10 "2023-10-27T15:51:19Z")

</div>

Thanks, we'll talk to the other vendor support. I appreciate the help!

Would you be able to hide the host-name and domain?

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [October 27, 2023, 11:33pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/11 "2023-10-27T23:33:26Z")

</div>

I personally use HAProxy instead of NGINX, but typically you have to pass the X-Forwarded headers, and could it possibly be misconfigured? Here's what it would typically look like I believe:

```auto
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Forwarded-Port $server_port;

```

Also, under the Ignition configuration for Networking/Web Server, do you have the Use Proxy Forwarded Headers checked/enabled?

---

<div class="post-metadata">

**Author:** ![dferrie1](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@dferrie1](https://forum.inductiveautomation.com/u/dferrie1)\
**Post date:** [October 28, 2023, 10:27pm UTC](https://forum.inductiveautomation.com/t/nginx-reverse-proxy-returning-552-after-update-to-8-1-33/81053/12 "2023-10-28T22:27:32Z")

</div>

Thanks Michael, it has been resolved.

If you're using Akamai EAA product, you also need to set the Internal Host property, otherwise the FQDN and port number for the application server are used as the server name.

Over the thanks giving break, just out of interest, we're going to look into the 8.1.30 server to see how JAVA is handling those requests.