F5 SSL Handshake Fail: tmsh show ltm profile client-ssl When Chrome Says Protocol Error

F5 BIG-IP · Techclick CLI troubleshooting lab

VIP is up. Chrome says ERR_SSL_VERSION_OR_CIPHER_MISMATCH. The pool member is healthy.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on F5 BIG-IP for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

This is the client-ssl profile, not the pool. Cipher list, TLS version, or SNI/cert mismatch.

Why this ticket shows up

F5 terminates TLS on the client-ssl profile. A pool of modern nginx boxes cannot save an old profile that only offers TLS 1.0.

Symptoms operators actually see

• Browser cipher mismatch

• openssl s_client fails at handshake

• Pool members green

• Started after you disabled old TLS

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh list ltm profile client-ssl clientssl-web
tmsh show ltm profile client-ssl clientssl-web
openssl s_client -connect vip.example:443 -servername vip.example
tmsh show ltm virtual VS-WEB

How to read that output

s_client will print the offered cert and protocol. If it dies before ServerHello, the profile ciphers or TLS versions do not overlap the client.

Triage order

1. s_client to the VIP with SNI

2. Read ciphers and TLS min/max on the profile

3. Confirm the certificate matches the FQDN

4. Add TLS 1.2/1.3 ciphers as policy allows

5. Retest Chrome and a legacy client separately

Classic traps

What you see	Real cause	Fix
Restart the pool	Handshake never reached servers	Fix client-ssl
Turn TLS 1.0 back on forever	One old scanner	Give that scanner a separate VIP
Replace the cert blindly	s_client already shows the right CN	It is ciphers

Proof the ticket is closed

• s_client shows TLS 1.2 or 1.3

• Chrome loads

• Pool still unused until after handshake — and that is correct

Say this in an interview

Cipher mismatch on a green pool is the client-ssl profile. The servers have not spoken yet.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/