Dropped due to failed client SSL handshake

Secure Internet Access (ZIA)
1

Team,

Anyone have faced this error “Dropped due to failed client SSL handshake” ?

2

Some kind of certificate error caused by broken\expired\revoked certificate or incorrect SSL inspection policy being applied.

3

Hi Gordon,

Thanks. Does this mean any issue at Client SSL handshake initiation?

4

Yes I think that’s what it means.

5

Check the website without zscaler as well. This may be because of web server misconfiguration as well

6

I’m seeing this a lot now too. And it works fine when not connecting through ZIA, so it’s not a website problem.

Even more strangely, I’m seeing it for connections to courier.push.apple.com and I have that host excluded from SSL inspection.

7

SSL errors can happen on the client-side or the server-side. Involve support team and ask them to capture the packet at Zscaler end and do the same at client end. So that we can see the ciphers and other parameters used, negotiation status which will give more insights.

8

I do see this error logs , frequently for application specific destination
By Passing the SSL inspection temporarily fixed the issue