Our BizTalk installation consists of two load balanced nodes B1 (
10.137.10.1) and B2 (
10.137.10.2) which process and route incoming SOAP messages.
The processing is nothing more than:
- sending the SOAP request message to an external web service (WS) (out of our control),
- wait for the reply
- and route the response back to the original caller.
In front of the web service there is an nginx reverse proxy (RP, WS/RP:
The connection between the BizTalk nodes (B1, B2) and the WS (or actually RP) will be HTTPS (TLSv1) with mutual/two-way authentication.
All goes fine when messages are routed by node B1. A proper TLSv1 handshake is performed and eventually application data (the request and response message) are exchanged. See screenshot below.
Wire shark on node B1. (everything goes fine)
- RP requests certificate at packet 63. (At 459 seconds mark.)
- B1 answers at packet 69. (Also at 459 seconds mark.)
B2 falls silent
Messages processed by node B2 fail. We don't see a proper TLSv1 handshake. After the server requests the certificate from the client it goes silent.
Wire shark on node B2. (client goes silent after server certificate request)
- RP requests certificate at packet 27. (At 96 second mark.)
- B2 does not answer.
- RP times out (?) and closes the connection at paket 31. (At 155 second mark.)
Could you guys and girls think of one reason why this could happen? We checked the configuration on both B1 and B2 and we don't see deviations.
Also testing the connection with OpenSSL from node B2 works perfectly. Command was this:
openssl.exe s_client -connect RPHOSTNAMEHERE:443 -state -tls1 -debug -cert client_ssl.pem -key client_ssl.pem
Could this be a problem with SChannel? What would be a reason to not send the client certificate upon server request?
Also the event logs don't give us any leads.