How to debug TLS issues between Nginx and upstream service using tcpdump or curl?

To debug TLS issues between Nginx and an upstream service, you can use tcpdump and curl as follows:

1. tcpdump

• Run tcpdump on the server where Nginx is running to capture traffic between Nginx and the upstream service on the relevant port (usually 443 or another if TLS):

tcpdump -i eth0 host <upstream_ip> and port <upstream_port> -w capture.pcap

• Analyze capture.pcap in Wireshark, filtering by TLS (e.g., tls.handshake.type == 1 for ClientHello) to see if the TLS handshake passes, which versions and ciphers are used, and if there are errors.

2. curl

• Use curl with the --verbose or -v option to connect directly to the upstream service from the Nginx server:

curl -v https://<upstream_host>:<port>/path

• Pay attention to TLS error messages, such as certificate mismatches, SNI issues, unsupported TLS versions.

• You can specify a particular TLS version or cipher suite for testing:

curl --tlsv1.2 -v https://<upstream_host>:<port>/path

3. Additional

• Check Nginx configuration: proxy_ssl_protocols, proxy_ssl_ciphers, proxy_ssl_verify parameters.
• Ensure certificates and trust chains are correct.

Thus, tcpdump helps visualize low-level traffic and handshake, while curl tests the connection and provides TLS diagnostic messages.