nginx reverse-proxy upgrade from nginx 1.17 to nginx 1.18 gives SSL error

I am having trouble upgrading nginx from 1.17 to 1.18 (or .19, .20) Everything works ok on 1.17, but higher versions give this error:

2021/08/27 01:14:45 [error] 22#22: *8 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking to upstream, client: 192.168.**.**, server: api*******.hm.*******.gov.br, request: "GET /favicon.ico HTTP/1.1", upstream: "https://192.168.**.**:443/favicon.ico", host: "api*******.hm.********.gov.br"

The error only happens when upstream is a internal IIS server. When upstream is another nginx it works with versions above 1.17

config is basically:

location  / {
    proxy_pass https://$host.***.br$uri$is_args$args;

I tried to use proxy_ssl_verify off without success. IIS certificate is self-generated.

Please advise

Solution 1:

This looks like a problem with TLS versions. Maybe your backend IIS server isn't new enough to support TLS protocol that nginx requires?

Try adding proxy_ssl_protocols directive that contains the SSL / TLS versions your IIS supports.