Server is responding OpenSSL: : SSL: : SSLError: Receivedfatalalert: handshake_failure - docker

Question

I have taken a project builded with Laravel 4.2 and PHP 5.6.

And have mounted the server with Docker.
The server uses Nginx, certificates from Let’s Encrypt with Certbot.
These are the configuration files of the Nginx:
nginx.conf
server {
index index.php index.html;
error_log /var/log/nginx/error.log;
access_log /var/log/nginx/access.log;
root /var/www/public;
server_name example.com.py www.example.com.py;
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass app:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
}
location / {
try_files $uri $uri/ /index.php?$query_string;
gzip_static on;
}
listen [::]:443 ssl http2 ipv6only=on; # managed by Cetbot
listen 443 ssl http2; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/example.com.py/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com.py/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
and options-ssl-nginx.conf
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.
ssl_session_cache shared:le_nginx_SSL:40m; #holds approx 40 x 4000 sessions
ssl_session_timeout 2h;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
The project is an E-commerce that conects with a local Credit Card Payments procesor company.

Everthing works fine until the Payments procesor, responds to a url in my server for payment confirmation.

Here is what my server responds to the Payments procesor when it sends the request to the payments confirmation url:
[Status 500]
OpenSSL: : SSL: : SSLError: Receivedfatalalert: handshake_failure
I have no log of any error or anything in my laravel.log or my nginx log.

I copy pasted the same request and reproduced it with Postman and it works fine returning the correct 200 response.

The payment procesor told me that i need to validate only certificates with TLS1.2 and above and as you can see in my options-ssl-nginx.conf
 file, thats already validated.

Does Anyone knows what could be missing?
Thanks in advance
UPDATE 1:
I raised the level for the error logs of nginx, and i got the following errors:
This one with a test:
SSL_do_handshake() failed (SSL: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher) while SSL handshaking, client: 190.128.218.209, server: 0.0.0.0:443
I also got this one some hours before:
SSL_do_handshake() failed (SSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol) while SSL handshaking, client: 3.236.110.87, server: 0.0.0.0:443

Answer 1

ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
You cipher set is very restrictive, i.e. there are only 5 TLS 1.2 ciphers for RSA certificates (the ECDSA ones are likely irrelevant since you likely don't use a ECC certificate). It might well be that the specific client used by the payment processor company neither supports these TLS 1.2 ciphers nor supports TLS 1.3.
It might be useful to just comment out the ssl_ciphers line so that it falls back to the default settings, which are usually (with current versions of OpenSSL) are still secure but broader.