ALB Node SSL Connection Failure - One of Two Nodes Returns SSL_ERROR_SYSCALL in eu-central-1

This issue appears to be related to an SSL/TLS negotiation failure occurring specifically on one of your Application Load Balancer (ALB) nodes. When SSL/TLS negotiation errors occur, they typically don't show up in ALB Access logs because the connection fails before a complete handshake can be established.

To troubleshoot this specific issue where one ALB node is failing with SSL_ERROR_SYSCALL while the other works correctly, I recommend the following approach:

1. Enable VPC Flow logs on the Elastic Network Interfaces (ENIs) of your ALB nodes. This will allow you to compare traffic patterns between the working node (3.120.93.177) and the failing node (18.193.12.143). The failing node's IP may appear in VPC Flow logs but not in ALB Access logs, confirming an SSL/TLS negotiation failure.

2. Enable connection logs for your ALB. Connection logs provide more detailed information about the TLS handshake process, including security protocols and cipher suites being used during negotiation.

3. Capture client-side packet data using tools like tcpdump or Wireshark when connecting to both nodes to determine any differences in the negotiation process. Focus on the "Client Hello" packet and the server's response (or lack thereof).

4. Check if there are any intermediary network devices or configurations specific to eu-central-1b that might be interfering with the TLS handshake on the failing node.

5. Compare the TLS security policy and supported protocols/ciphers on both ALB nodes to identify any potential mismatches or configuration issues.

Since this appears to be an infrastructure issue affecting only one node, and you've already verified that targets are healthy in both AZs, security groups are configured correctly, and the SSL certificate is valid, it's likely an issue with the specific ALB node in eu-central-1b. If the above troubleshooting steps don't resolve the issue, you should contact AWS Support with the detailed information you've gathered, as this may require intervention at the AWS infrastructure level.
Sources
Why do SSL/TLS negotiation errors occur when connecting to an Application Load Balancer over HTTPS, and how can I identify the responsible client IP? | AWS re:Post
Troubleshooting ClientTLSNegotiationErrorCount in AWS Network Load Balancer | AWS re:Post