Inconsistent api gateway SSL answer

Context : I have the following "simple" infrastructure : client --- mTLS request --> api gateway --> lambda

Test #1 : mTLS request: I've tested a loop of 50 calls on my API with mTLS, and depending of the environment I have between 0% of errors to 20% errors, with the following error return :

for i in range(1,50):
    resp = requests.post('https://subdomain.domain/dp',headers=headers, data=None,cert=CERT_TUPLE)

with the following exception :

requests.exceptions.ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

The following repost topic suggest an ssl error : https://repost.aws/questions/QUhIDK9NkpSJiF4l-jmqgfmQ/api-gateway-intermittent-ssl-connect-connection-reset-by-peer I have investigated this way with the following test :

Test #2 :openssl test:

for i in {1..50}
do
openssl s_client -connect subdomain.domain:443 -servername domain>/dev/null 2>&1
status=$?
echo "status code : $status"
done

With this command I have also **multiple ** returned code : 1 and 104 and the negotiation is different between a correct negociation and an incorect negociation.

Correct negociation :

Client Certificate Types: RSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA256:RSA+SHA384:RSA+SHA512:RSA+SHA224:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ECDSA+SHA224:RSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA+SHA256:RSA+SHA384:RSA+SHA512:RSA+SHA224:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ECDSA+SHA224
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 4325 bytes and written 454 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: B81448EC098C8B296B652D984E4188EC3A4381626F97656502A78B78D3FDC83B
    Session-ID-ctx:
    Master-Key: 443723FE82C74D633F6809115839B660A78B36CBE2FAD0069DFB042AFA0A4AA77946FFC9279C01A5EA4515A1D95FFAF1
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1732689901
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes

Incorrect negociation:

Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:RSA+SHA224:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ECDSA+SHA224:RSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4442 bytes and written 410 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

In the both examples, the call is identical and done one after the other.

• Could it be an inconcistancy in the aws api gateway loadbalancing farm ?
• Have you already seen this error ?
• How can I bypass this error ?

Regards,