TLS 1.2 not working with forced curl

Question

I have 2 identical ubuntu 12.04 servers behind Amazon ELBs. One server is able to connect using TLS v1.2 while the other server is not able to make a curl request using TLS v1.2

Below is the code I have used for checking connectivity and versions. A simple curl request to https://www.howsmyssl.com/a/check site which return the available cipher suites and tls_version using php test_curl.php

<?php
function get_tls_version($sslversion = null)
{
    $c = curl_init();
    curl_setopt($c, CURLOPT_URL, "https://www.howsmyssl.com/a/check");
    curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($c, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);
    if ($sslversion !== null) {
        curl_setopt($c, CURLOPT_SSLVERSION, $sslversion);
    }
    $rbody = curl_exec($c);
    if ($rbody === false) {
        $errno = curl_errno($c);
        $msg = curl_error($c);
        curl_close($c);
        return "Error! errno = " . $errno . ", msg = " . $msg;
    } else {
        $r = json_decode($rbody);
        curl_close($c);
        return $r->tls_version;
    }
}

echo "OS: " . PHP_OS . "\n";
echo "uname: " . php_uname() . "\n";
echo "PHP version: " . phpversion() . "\n";
$curl_version = curl_version();
echo "curl version: " . $curl_version["version"] . "\n";
echo "SSL version: " . $curl_version["ssl_version"] . "\n";
echo "SSL version number: " . $curl_version["ssl_version_number"] . "\n";
echo "OPENSSL_VERSION_NUMBER: " . dechex(OPENSSL_VERSION_NUMBER) . "\n";
echo "TLS test (default): " . get_tls_version() . "\n";
echo "TLS test (TLS_v1): " . get_tls_version(1) . "\n";
echo "TLS test (TLS_v1_2): " . get_tls_version(6) . "\n";
?>

2 servers give the below responses;

server 1

OS: Linux
uname: Linux www-leapset-us-west-1b-n1-new 3.2.0-31-virtual #50-Ubuntu SMP Fri Sep 7 16:36:36 UTC 2012 x86_64
PHP version: 5.3.10-1ubuntu3.4
curl version: 7.22.0
SSL version: OpenSSL/1.0.1
SSL version number: 0
OPENSSL_VERSION_NUMBER: 1000100f

TLS test (default): TLS 1.1
TLS test (TLS_v1): TLS 1.0
TLS test (TLS_v1_2): TLS 1.1

server 2

OS: Linux
uname: Linux stag-order-ec1.leapset.com 3.2.0-40-virtual #64-Ubuntu SMP Mon Mar 25 21:42:18 UTC 2013 x86_64
PHP version: 5.3.10-1ubuntu3.11
curl version: 7.22.0
SSL version: OpenSSL/1.0.1
SSL version number: 0
OPENSSL_VERSION_NUMBER: 1000100f

TLS test (default): TLS 1.2
TLS test (TLS_v1): TLS 1.0
TLS test (TLS_v1_2): TLS 1.2

Also, I spawned a docker instance with ubuntu 12.04 identical to the servers and executed the given file using php curl_test.php and it also behaved in the same manner as server 2

Further more curl --version on 2 servers give the following output in the 2 servers and they have the same versions and they match

server 1 and server 2 both

curl 7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtmp rtsp smtp smtps telnet tftp 
Features: GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP

Also command: openssl version in both the servers are same. server 1 and server 2 both

OpenSSL 1.0.1 14 Mar 2012

Security policy enabled in ELBs are same and as described in here https://aws.amazon.com/about-aws/whats-new/2017/02/elastic-load-balancing-support-for-tls-1-1-and-tls-1-2-pre-defined-security-policies/ they are default configuration ELBSecurityPolicy-2016-08 which corresponds to the pre-existing default settings, and supports TLS version 1.0 and higher.

Further more,I have found out that curl uses underlying openssl for handling TLS. Therefore, I checked openssl connectivity using TLS v1.2

In the server 1; when used the following command to check openssl connectivity

openssl s_client -connect google.com:443

it connects using TLS v1.1 However, when I force TLS v1.2 using openssl s_client -connect google.com:443 -tls1_2

it is able to connect to google.com:443 using TLS v1.2 and it uses ECDHE-RSA-AES256-GCM-SHA384 cipher scheme for connectivity.

Then I tried; openssl s_client -cipher 'ECDHE-RSA-AES256-GCM-SHA384' -connect www.google.com:443

and it failed in server 1 but worked in server 2

Further; openssl s_client -cipher 'ECDHE-RSA-AES256-GCM-SHA384' -connect www.google.com:443 -tls1_2 works fine in server 1 and connects using ECDHE-RSA-AES256-GCM-SHA384 cipher scheme.

I am unsure why server 1 is not able to connect using TLS v1.2 in curl requests and I am not in a position to update the openssl version or curl version because server 1 is a production server.

Further,

I checked /etc/ssl/openssl.cnf and /usr/lib/ssl/openssl.cnf in both the servers and they are also identical.

Any help to debug or enable/force tls 1.2 in server 1 is very much appreciated.