Symptoms
The BIG-IP system resets an HTTPS connection. SSL handshake failure logs appear in /var/log/ltm:
warning tmm1[2555]: 01260013:4: SSL Handshake failed for TCP 10.0.0.l0:443 -> 10.0.0.20:60716
In the server-side packet trace, there is no Client Key Exchange message in response to the Server Hello Done message. The connection then is reset 10 seconds after the Server Hello Done message.
Impact
Clients cannot connect to the HTTPS pool members.
Conditions
-- OCSP is configured for the server SSL profile.
-- The OCSP responder cannot determine the intermediate CA cert status.
Workaround
For each affected host, add the certificate of the issuer of the server certificate to the CA bundle specified in the Trusted CA field of the server SSL profile.