Ssl handshake failed что за ошибка

How to fix "SSL handshake failed error"? What is it?

It is an essential method over the web for data transfer. Do you know what is SSL Handshake Failed error? How to fix SSL Handshake Error? This blog post will guide you to accomplish this task.

List of content you will read in this article:

1. Causes of SSL Handshake Failed Error
2. How to Fix SSL Handshake Error?
3. Take Away

Do you know what is SSL handshake and how to fix SSL handshake errors?

SSL handshake request is initiated for a secure connection to a web server. After the request is made, a public key is sent to your computer by the server. Your computer is then tasked to check the certificate against other certificate authorities. If the certificate is accepted, a key is created and encrypted with the server’s public key. At this point, the handshake is considered successful.

In another case, however, the handshake fails when the server or client fails to establish a connection through the protocol. When the handshake fails, the connection to the server is rendered insecure. This may affect your communication.

The role of the SSL handshake is to create secure connections for web users providing a safe space for website transactions.

Causes of SSL Handshake Failed Error

An «SSL Handshake Failed» error indicates that the browser and server could not establish a secure connection, and the error may appear on both the server and client sides.

The error occurs when:

There is an interception of the client-side connection by a third party.
The client is using the wrong time and date.
The client’s browser configuration is incorrect.
The server and the client do not support a similar SSL version.
Different Cipher Suites are being used by the client and server, creating a mismatch.
The certificate is invalid, expired, or unfinished.

How to Fix SSL Handshake Error?

There are multiple ways through which we can fix SSL handshake failure. The remedies for the error are often based on the error’s cause.

1. Invalid certificate

The SSL handshake failure will occur if you have an expired, invalid or incomplete certificate, issues on an SSL certificate will impede the completion of a handshake causing the error. Some of the certificate issues to look out for include the wrong hostname, the certificate having passed its expiration date, and not being installed correctly.

It is essential to check and ensure that the SSL certificate is renewed and installed correctly. The hostname used in the URL must match the hostname on the certificate. You can also use SSL checker tools to check if the certificate is correct and if the installation has been done properly.

2. Fix the time and date

Updating your system’s time and date is one of the easiest fixes for the error and probably one you should check first. If the time and date on your computer are incorrect, the handshake will not be complete. While this may seem unimportant, it is critical as SSL certificates are time-bound and become invalid after their expiration.

Therefore, your computer’s time and date should match the actual date to avoid interrupting the handshake. Due to human error, your time and date may be incorrect, so this should be the first stop. If everything looks good, it is a sign that this is not the cause, and you can move to other options.

3. Ensure the Cipher Suites Match

Cipher Suite mismatch is one of the common causes of a failed SSL handshake. It occurs when your browser fails to establish a secure connection with a server that uses SSL or HTTPS.

When the Cipher Suites used by a server do not match or support the one used by a browser, an SSL Handshake Failed error will occur.

How do you establish if there is a mismatch? It will help if you compare your browser’s Cipher Suites and the server support in the SSL Labs. Here are the steps.

Click on «Projects.»
Select «SSL Client Test.»
Under SSL Client Test, scroll to «Protocol Features» and open it. You will get a list of the Cipher Suites your browser supports.
In a different tab, open SSL Labs and select «Projects.»
Click on the «SSL Server Test» option and populate the provided field with the domain name resulting in the error.
Confirm that the server and your browser use the same Cipher Suites.

4. Try another browser

Your browser could be why you are getting the SSL Handshake Failed error. This could be due to your browser plugins and settings, among other issues. If you have ruled out the other cause, you could check if your browser is the cause of the error.

Switch to another browser and see if you are getting the same error. If you are using Google Chrome, for instance, and getting the error, try a different browser like Microsoft Edge to confirm if your browser is the problem.

If the handshake does not fail in Microsoft Edge, you need to reset your Google Chrome browser to default and disable your plugins. It is recommended that you disable the plugins one by one as you test the website to make it possible to identify which plugin is causing the issue.

If you are still getting the error with a different browser, the problem is not your browser configuration.

5. Update your browser

If your browser and server do not support the same SSL version, you will get the error, and the remedy would be updating your browser.

Updating your browser will fix the current protocol mismatch and allow it to use the latest SSL protocol. Note that the server will always support the latest SSL version, but your browser may need an update.

After updating your browser, it is expected that the browser will have Transport Layer Security (TLS) 1.2 automatically enabled. You have to ensure the configuration supports the latest TLS version in instances where it is not.

You can confirm if the configuration is okay using the following steps.

Open SSL Labs
Go to «Projects.»
Select «SSL Client Test.»
Under SSL Client Test, select «Protocol Support,» Here, you will establish whether your browser supports the latest TLS version.

If your browser and server are using the same protocol, it is a sign that your browser version is not the issue.

Take Away

A successful SSL Handshake is essential for data to be transferred securely over the internet. However, sometimes the handshake may be unsuccessful, and the server will fail to establish a secure connection.

The good news is that the causes of the SSL Handshake Failed error can be fixed easily with the steps listed above. If you fill any other methods available to solve this, please comment via the comment section.

Sorry, you have been blocked

This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

What can I do to resolve this?

You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

Cloudflare Ray ID: 7a703ef3e8802d67 • Your IP: Click to reveal 88.135.219.175 • Performance & security by Cloudflare

How to Resolve error during SSL Handshake with Remote Server?

With advanced technology, a lot of things have developed when it comes to networks as well as coding, In this article, we will be discussing issues faced when you try to perform an SSL handshake with remote or local server. But before we proceed to know the reasons, the solutions or how these issues can be handled in real life scenarios, Let us now understand the basics included in the process.

Apache Server

Apache is a free and open source server software that runs with Apache License 2.0, It is developed and maintained under Apache Software Foundation, Most of the Apache services runs on Linux, However, they have developed so that it can be used on Windows and OS2 and on Unix as well.

How an SSL handshake is carried out? Types?

SSL handshake is initiated when the browser on your device forwards a secure connection request to a Web server. The server sends a public key to your computer, and the remote computer checks the certificate with a known list of certificates. Once the certificate is accepted, the computer generates a key and then encrypts it using the server’s public key.

SSL handshakes are basically two types:

Basic SSL handshake
Client Authenticated SSL handshake

The basic model here lets the client verify the server, and a number of sessions secured by TLS only require this. However, some cipher suites will require the client to also send a certificate and public key for mutual authentication of both parties which as above is the client authenticated SSL handshake. This two-way authentication will, of course, add to the handshake effectively as the security increases when both the parties provide valid authentication steps to confirm the handshake, However, in some cases, the cipher suite will be needed to recommended to complete the process which in turn adds extra security to the session.

A SSL handshake includes multiple stages, each managed according to different set of rules. but the issue here is that rather than a series of separate back and forth connections as to what keys to use, how to encrypt the handshake, how to authenticate the handshake and vice versa, the origin and target parties can agree on a “cipher suite which is an existing kit of agreed-upon components. TLS specifications, however, allows quite a number of cipher suites, and the client and server will almost always have access to one set of agreed upon components.

Let us check some scenarios where the error occur and how it was resolved.

Upgrading servers without understanding the pros and cons are dangerous and can lead to huge confusions, A lot of Linux admins working on Apache version 2.2 encountered the same “ Error SSL handshake failed with server “ due to an upgrade in the server versions. Now it might be meaningless for you to hear that a simple server upgrade is causing this issue.

Replicating the error :

Consider an Apache running on port 443 and a web app working on Tomcat running on port 8443 on Ubuntu.

You can set up Apache as reverse proxy so that you can access the web app running on Tomcat using port 443 instead of 8443. With having SSL connection between both the Browser and Apache and also Apache and Tomcat, SSL is set up on both Apache and Tomcat. The web app works fine while accessed through Tomcat, But if you try accessing the web app running on Tomcat through Apache which is set up as Reverse proxy you will be getting an error as below:

Proxy Error The proxy server could not handle the request GET /web_app.

Reason: Error during SSL Handshake with remote server

This usually happens when either mod_ssl module or the directives are not specified correctly.

Based on the set up, there are 2 suggestions to fix the issue to have the server running fine without errors depending on the nature of the error:

Modifying/Adding directives under the mod_ssl module as below:

Читать:

Что можно делать на питоне

SSLProxyEngine on

SSLProxyVerify none

SSLProxyCheckPeerCN off

SSLProxyCheckPeerName off

SSLProxyCheckPeerExpire off

Checking if there is an additional ssl.conf file which has replaced or added while copying the *.conf file during the transition of 2.2 to 2.4, This can cause conflicts as both the files will have the same directives and none of them will respond, Removing one of them and restarting httpd will fix the issue.

When the NAM is upgraded to version 4.3 without changing any other features, there will be a compatibility issue with the additional files supporting the server set up, The below mentioned error appears when NAM is upgraded without testing the additional files.

The server encountered an internal error.

The proxy server could not handle the request

Reason: Error during SSL Handshake with remote server.

While checking the device manager error log files under — /opt/novell/devman/jcc/logs/ the following set of error is replicated.

/opt/novell/devman/jcc/logs/jcc-0.log.0:INFO: Executing /opt/novell/ssllib/bin/c_rehash /opt/novell/apache2/cacerts

/opt/novell/devman/jcc/logs/jcc-0.log.0:Cannot run program “/opt/novell/ssllib/bin/c_rehash” (in directory “/”): error=2, No such file or directory

/opt/novell/devman/jcc/logs/jcc-0.log.0:java.io.IOException: Cannot run program “/opt/novell/ssllib/bin/c_rehash” (in directory “/”): error=2, No such file or directory

However, this issue can be resolved by making the changes as below:

create the “/opt/novell/ssllib/bin/” directory
create the following module “c_rehash” and copy it into the “/opt/novell/ssllib/bin/” directory

#!/bin/sh

# print out the hash values

# based on /etc/pki/tls/misc/c_hash part of the openssl-1.0.0

export OPENSSL_CONF=/opt/novell/openssl/ssl/openssl.cnf

export LD_LIBRARY_PATH=/opt/novell/openssl/lib

w=”WellKnownThirdPartyTrustedRoots_auto.pem”

echo >&2 “$@”

exit 1

#[ “$#” -eq 1 ] || die “One directory argument required, $# provided”

#[ -d “$1” ] || die “Directory $1 does not exist”

cd /opt/novell/apache2/cacerts

printf “removing all old hash files \n”

rm *.0 -v

printf “creating new hash files \n”

for i in $(ls *.pem);

printf “$i \n”

h=`/opt/novell/openssl/bin/openssl x509 -hash -noout -in $i`

if [ “$i” != “$w” ]; then

ln -svf $i $h.0;

#echo “$h.0 => $i

done

flag the script executable: chmod 755 c_reshash
execute the script
restart the Access Gateway

The above changes in commands will help you fix the issue, However, you should be sure that any aspect is not given a wrong value which will, in turn, throw the same error.

In the previous article, we have seen how small changes in the commands have fixed the issues with SSL handshake to a remote or a local server, But it is quite surprising that a change in date or time will also affect the functionality or the connections causing SSL errors. The best way to check it is by following the below steps.

Go your Windows Start screen, and then choose the current date and time.
Choose “Settings > Change the time and date > Change the Internet Time > Save Settings.
Move the date 2–3 years ahead of the present time by clicking on the right arrow under the “Date” heading. Click “OK” to save the changes. You must select a date much ahead of the actual time to cause a date discrepancy between the computer and the SSL certificate used on the Web server. The large difference in date and time will cause the SSL handshake to fail.
Restart your computer.

Once you have made the changes as suggested above, Follow the steps:

Open a Web browser and visit a website that you know is secure or has https on all its internal links as well, for example, your bank or an online store.
Try to log in to your bank account or add items to your shopping cart in order to initiate an SSL session which can be done as payment gateways on every bank or online stores are secured with https.
Within few seconds an error message will appear on your browser, warning you that the server’s SSL certificate is not yet valid or expired, and due to which the SSL handshake has failed.

This is a rare issue but very important while your target is an SSL handshake with web server be it remote or local server. Normally when the error is triggered you get an Error 525: SSL handshake failed, Error 525 indicates that the SSL handshake between Cloudflare and the origin server failed. This normally occurs when the domain is using a Cloudflare Full SSL mode.

The most common issues that cause Error 525 are:

The origin server does not have a valid SSL certificate.
The server is not working on port 443 or possibly configured on custom ports.
The web server does not support SNI or Server name indication.
The cipher that Cloudflare uses and the cipher suites that the origin server uses are different.

Although there are no definite steps to resolve the issue, Here we have few steps that can be used to troubleshoot the cause:

Apache must be configured to work as per log mod_ssl errors.
Increasing the log level and adding these error logs in Nginx.

Conclusion

Discussed above are some cases where small changes have led to failed handshake attempts, It is always recommended to contact or take advice from a server administrator while you imply any changes on the server, With Date and time causing an error to an invalid SSL certificates, the possibilities are numerous, It is how you go about it or take measures to avoid these issue which matters. Ever faced any issue with SSL handshakes other than the ones listed above, Let us know in comments below.

How to Fix the SSL/TLS Handshake Failed Error?

If you’re not having the right answer to what this SSL error means, then no worries, we’ve got your back. Read further and know what’s this SSL Handshake Failed Error, why it occurs, and how to fix the SSL/TLS Handshake Failed Error.

What Does SSL/TLS Handshake Failed Mean and What Causes It?

The SSL Handshake Failed error occurs when there’s a protocol mismatch. In other words, whenever the client and the server do not have mutual support for the same SSL/TLS version, it shows this SSL/TLS Handshake failed error message.

Once the user sends the secure connection request to the web browser, the browser is expected to send a public key to your computer, which is automatically verified against a list of CAs. And, the computer generates a key and encrypts it with the public key after receiving the certificate.

This SSL/TLS Handshake Failed Error occurs whenever the OS hasn’t granted the read access to the OS, ultimately preventing the complete authentication of the webserver, which indicates that the browser’s connection with the web server is not secure.

Some Reasons That Causes SSL/TLS Handshake Failed Error

The name on the certificate doesn’t match with the hostname in the URL.
Incomplete or invalid certificate chain.
The SSL/TLS Certificate is expired or revoked.

Here’s the Client-Side Errors and its Solution

Whenever an SSL/TLS Handshake fails, it’s mostly due to certain things going on with the server, website, and the configuration of its installed SSL/TLS.

Presently the culprit is TLS configuration as support for SSL 3.0 is deprecated. However, there’s a distinct possibility that a client-side error can be the reason behind the SSL/TLS Handshake Failed error. And, some of the common ones are like incorrect system time or browser updates.

Let’s see some of the common causes of SSL Handshake fail error in detail.

1. Incorrect System Time

Not always happen, but sometimes the system clock differs from the actual time. Maybe you did it intentionally, accidental change of settings, or any other reason. It’s a fact that SSL/TLS certificates come with a specific validity period, so the date and time of the system is equally important.

So, the solution is to change the system time and date to correct one, if the system clock is not showing the right time and date. But again, there’s no need to change your system time if it’s correct, as it’s likely that the cause of the error is not the System time.

2. Browser Error

For instance, if you’re using Google Chrome, then try using Mozilla Firefox or any other such as Apple Safari if OS is Mac or else Microsoft Edge for Windows.

However, if you still face the SSL/TLS Handshake Failed error, even after changing the browser, then the issue is not regarding browser but, most probably, the plugin. To verify whether the error can be solved or not, it’s recommended to disable all your installed plugins and reset your browser settings to default.

3. Man-in-the-Middle

Nevertheless, sometimes issues occur with such devices, which causes the SSL Handshake Failure error. And, the reason could be a network firewall preventing the connection or else configuration on an edge device on the server-side network, which means there’s a possibility that this error could be from the client or server-side depending upon the scenario.

Lastly, if the issue is from the client-side, then you can take a chance of exposing yourself by tweaking the settings on your VPN or antivirus. Though, never drop your antivirus or firewall to connect with a website. And, if the server is causing the issue, then mostly configuration is creating an issue on an edge device.

Here’s the Server-Side Errors and Its Solution

Let’s look at some of the common server-side issues.

1. Protocol Mismatch

For instance:

TLS 1.2 came more than a decade ago, and small segments of websites still fail to support it. Earlier back in March 2018, the final version of TLS 1.3 was published as RFC 8446 by the IETF. And, sites were also advised for adding support for TLS 1.3 at their earliest.

So, if the SSL/TLS Handshake Failure error is due to protocol mismatch, it generally means the client and server do not have mutual support for the same TLS version.

For example:

The client supports TLS 1.0 and TLS 1.1, whereas the server supports TLS 1.2.

As shown in this example, the TLS protocol is not supported mutually. So, it’s likely that the server won’t support backward versions. Nevertheless, the server shouldn’t fix this as well. In this above example, the client must be recommended to upgrade their browser, or else it must be latest with the latest TLS version supported. Presently all we can suggest is that TLS 1.2 or TLS 1.3 must be used, or else support must be added for it.

2. Cipher Suite Mismatch

Nevertheless, Cipher Suites used by TLS 1.3 has been refined. Earlier, Cipher Suite has algorithms that handled:

Symmetric Session Key Encryption
Asymmetric Public Key Encryption
Signature Hashing
Key Generation

Different Organizations and Government Agencies have different types of encryption standards that suggest different kinds of cipher suites so clients can have different options while being able to find a mutually acceptable cipher. No doubt, it’s less likely that you get a site that only supports a single cipher suite.

Many times, it happens within a network, if you’re doing SSL bridging, where an edge device receives and decrypts HTTPS traffic and then re-encrypts it to send it to the application server. If the application server and edge device fail to share a mutually supported cipher suite, it will cause errors. Similar to Protocol versions, it’s also advisable for cipher suites, to never go backward but only moves forward.

Lastly, a protocol version or cipher suite is deprecated because there’s a vulnerability in that version. So, going back to the earlier version will only make your connection less secure.