Troubleshooting ClientTLSNegotiationErrorCount in AWS Network Load Balancer

The ClientTLSNegotiationErrorCount metric indicates that clients are failing to establish TLS connections with your load balancer. This typically occurs when there's a mismatch between the client's and load balancer's supported security protocols or cipher suites, or when the client fails to verify the server certificate.

To troubleshoot this issue, I recommend the following steps:

1. Enable connection logs for your load balancer if you haven't already. Connection logs (different from access logs) will show the security protocols and ciphers that clients are presenting to the load balancer during the TLS handshake.

2. Review the connection logs during the time period when the ClientTLSNegotiationErrorCount metric spiked. Look for patterns in the security protocols and cipher suites being used by clients that are failing to connect.

3. If you have access to the client that's failing to connect, perform a packet capture and review the "Client Hello" packet to determine the exact security protocols and cipher suites the client is attempting to use.

4. Use tools like tcpdump or Wireshark on the client side to capture and analyze the TLS handshake process.

5. Compare the client's supported protocols and ciphers with those supported by your load balancer's security policy to identify any mismatches.

6. Check if there are any intermediary network devices (like firewalls) that might be interfering with the TLS handshake.

7. Verify that the client is able to validate the server certificate presented by the load balancer.

Once you've identified the root cause, you can either:

• Update the load balancer's security policy to support the client's protocols and ciphers
• Update the client's configuration to use protocols and ciphers supported by the load balancer
• Address any certificate validation issues on the client side

If you're still experiencing issues after these steps, you may need to perform more detailed network analysis using tools like mtr or traceroute to identify any network path issues.
Sources
Troubleshoot SSL/TLS negotiation errors in Application Load Balancer | AWS re:Post
Why do SSL/TLS negotiation errors occur when connecting to an Application Load Balancer over HTTPS, and how can I identify the responsible client IP? | AWS re:Post
Resolve Network Load Balancer's TCP connectivity errors | AWS re:Post