requests with cipher(DHE-RSA-AES256-GCM-SHA384) fail with internal error
@mamckee is already working on this.
Since Oct 29, 2025.
Assessment
This issue has not been assessed yet.
Description
Our team recently moved our nginx image from CBL-Mariner to AzureLinux. After the move we started noticing some of the requests failing with the following error(from nginx logs) during TLS handshake.
SSL: error:0A0C0103:SSL routines::internal error
Upon further investigation we identified that AzureLinux uses SymCrypt under the hood as default crypto library.
When we made openssl the default library, the failures are gone and the request with cipher(DHE-RSA-AES256-GCM-SHA384) work as expected.
Change:
Test with openssl as default provider :
Test with SymCrypt as default provider:
Mariner Nginx Image: mcr.microsoft.com/cbl-mariner/base/nginx:1.22 (cipher mentioned here is working fine in this image)
Azure Linux Nginx Image: mcr.microsoft.com/azurelinux/base/nginx:1.25
Verified with curl from inside the container.
curl -k --tlsv1.2 --tls-max 1.2 --ciphers DHE-RSA-AES256-GCM-SHA384 -v https://localhost/status
OS Details:
root [ / ]# cat /etc/os-release
NAME="Microsoft Azure Linux"
VERSION="3.0.20250910"
ID=azurelinux
VERSION_ID="3.0"
PRETTY_NAME="Microsoft Azure Linux 3.0"
ANSI_COLOR="1;34"
HOME_URL="https://aka.ms/azurelinux"
BUG_REPORT_URL="https://aka.ms/azurelinux"
SUPPORT_URL="https://aka.ms/azurelinux"
RPM Details:
root [ / ]# tdnf list installed | grep SymCrypt
SymCrypt.x86_64 103.8.0-1.azl3 @System
SymCrypt-OpenSSL.x86_64 1.9.1-1.azl3 @System
root [ / ]# tdnf list installed | grep openssl
openssl.x86_64 3.3.5-1.azl3 @System
openssl-libs.x86_64 3.3.5-1.azl3 @System
root [ / ]#
- Dominant language
- C
- Stars
- 81
- Forks
- 15
- Avg merge
- 17h 18m
- Merged PRs (30d)
- 4
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/SymCrypt-OpenSSL
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
microsoft/SymCrypt-OpenSSL#170 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
microsoft/SymCrypt-OpenSSL#114 · 2 comments ·
All issues in microsoft/SymCrypt-OpenSSL
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
libsdl-org/SDL#16372 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
corazawaf/coraza-nginx#140 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
BasedHardware/omi#15662 · 1 comment ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
jamesstringer90/appsandbox#160 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100