If you see the following unexplainable errors occurring periodically:

/var/log/opscode/nginx/access.log

2020/08/25 16:34:33 [crit] 1626#0: *359555 SSL_do_handshake() failed (SSL: error:14094085:SSL routines:ssl3_read_bytes:ccs received early) while SSL handshaking, client: 10..10.10.10, server: 0.0.0.0:443

Then it is likely that you are observing an audit/security scan being performed by your team.

 

The errors mentioned in the summary are due to scanning from security appliances such as Tenable Nessus or Qualys. Scanning appliances will often make attempts to check ports/protocols for specific exploits. Although these look concerning they do not pertain to anything.
 

This is an example of attempting to uncover a known vulnerability in the chef server, specifically CVE-2014-0224, the ChangeCipherSpec injection vulnerability 97 and you are observing a failing attempt (which is a good thing). the "ccs" prefix to the message correlates "ChangeCipherSpec" which tells you the origin is from something referencing the CVE and likely part of your own internal security processes.

To remove these from your logs you will need to either:

• Submit Chef-server as an exception to your security team. This will remove this and any other appliance based testing from impacting your chef server. Chef-server should be deployed in a restricted environment. If your security team need to perform this regardless of your statement ask that they notify you ahead of time so you can correlate anything observed in logs to the planned scan.
• Ask that remove the test for CVE-2014-0224, the ChangeCipherSpec injection vulnerability 97 from their scanning appliance as it is unlikely to be reintroduced and is mitigated in multiple ways (depending on how you harden chef-server).
• Use a higher layer to remove access to chef-server from the scanning appliance i.e host fireballing, network ACL's or WAF rules.