Ah, so figured out the cause of the `SSL_SHORT_READ_ERROR`s we were seeing - something between the clients and kolide is enforcing a TCP idle timeout by sending a FIN/ACK to the client. The client kills the connection, but the server wasn't expecting the drop so hence the

SSL_SHORT_READ_ERROR

. This became obvious reviewing packet captures and noticing a the FIN/ACK being sent to the client consistently at the 240 second mark for every connection. We didn't have

tls_session_reuse

or

tls_session_timeout

set, so Kolide was running on the defaults of True/3600 seconds.