Security & SSL

TLS Handshake Failure

A TLS handshake failure occurs when the client and server cannot agree on a shared TLS version, cipher suite, or when certificate validation fails during the initial connection setup. This prevents any encrypted communication from being established, resulting in connection errors.

Symptoms

  • ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH in browsers
  • curl showing "SSL routines:ssl3_get_server_certificate:certificate verify failed"
  • API clients throwing TLS/SSL handshake exceptions
  • Intermittent connection failures to HTTPS services

Common Causes

  • Server only supports deprecated TLS versions (TLS 1.0/1.1)
  • No common cipher suite between client and server
  • Certificate hostname doesn't match the requested domain
  • Server certificate expired or not yet valid
  • SNI (Server Name Indication) not supported by the client

Step-by-Step Troubleshooting

  1. 1

    Check SSL certificate

    Verify certificate validity, hostname match, and chain completeness.

    Use SSL Certificate Check →
  2. 2

    Test HTTP headers

    Check the server response and identify any TLS-related headers.

    Use HTTP Headers →
  3. 3

    Scan SMTP TLS

    For email servers, test TLS handshake on SMTP ports.

    Use SMTP TLS Test →
  4. 4

    Update TLS configuration

    Enable TLS 1.2 and TLS 1.3 on the server. Disable SSLv3, TLS 1.0, and TLS 1.1.

  5. 5

    Configure modern cipher suites

    Use Mozilla SSL Configuration Generator to select appropriate cipher suites for your server software.

Recommended Diagnostic Tools

SSL Certificate CheckHTTP HeadersSMTP TLS Test

Monitor TLS Health

Track TLS configuration and detect handshake failures.

Related Problems

Frequently Asked Questions