gnutls_handshake() failed - why?
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
I am running the following command:
curl --tlsv1.2 -v --cacert ./mycert.crt --key ./key.pem --cert ./mycert.crt https://thirdparty.url
I received the certificate from the third party I am working with after generating CSR and key files with openssl.
My server IP is whitelisted on the third party's firewall and they can see my requests coming in but the handshake always fails.
This is the response I receive:
* Trying X.X.X.X...
* Connected to thirdparty.url (X.X.X.X) port 443 (#0)
* found 1 certificates in ./nonprod.crt
* found 596 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Handshake failed
* Closing connection 0
curl: (35) gnutls_handshake() failed: Handshake failed
How can I debug this issue?
Some info:
I am running curl 7.47.0 on Ubuntu 16.04.4
I try running this command:
openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem
BUT I have to exclude the link URI to make it work. The response does include this however:
140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
140593823835800:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:656:
But it also says:
SSL handshake has read 3378 bytes and written 1702 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: CE2294E9B415FB8B9850DB28F64FEF17390A46D5A38F12E62E31F614DA4199CF50C0AFA5F62401C4964105AFC4F1B095
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1528299660
Timeout : 7200 (sec)
Verify return code: 0 (ok)
ubuntu curl ssl handshake gnutls
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
asked Jun 6 at 14:55
cristobal
12
 |Â
show 3 more comments
up vote
0
down vote
favorite
I am running the following command:
curl --tlsv1.2 -v --cacert ./mycert.crt --key ./key.pem --cert ./mycert.crt https://thirdparty.url
I received the certificate from the third party I am working with after generating CSR and key files with openssl.
My server IP is whitelisted on the third party's firewall and they can see my requests coming in but the handshake always fails.
This is the response I receive:
* Trying X.X.X.X...
* Connected to thirdparty.url (X.X.X.X) port 443 (#0)
* found 1 certificates in ./nonprod.crt
* found 596 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Handshake failed
* Closing connection 0
curl: (35) gnutls_handshake() failed: Handshake failed
How can I debug this issue?
Some info:
I am running curl 7.47.0 on Ubuntu 16.04.4
I try running this command:
openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem
BUT I have to exclude the link URI to make it work. The response does include this however:
140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
140593823835800:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:656:
But it also says:
SSL handshake has read 3378 bytes and written 1702 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: CE2294E9B415FB8B9850DB28F64FEF17390A46D5A38F12E62E31F614DA4199CF50C0AFA5F62401C4964105AFC4F1B095
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1528299660
Timeout : 7200 (sec)
Verify return code: 0 (ok)
ubuntu curl ssl handshake gnutls
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
asked Jun 6 at 14:55
cristobal
12
You can try withopenssl s_clientit should give you more debug information. Do not forger the-servernameparameter to enable TLS SNI proper negotiation
– Patrick Mevzek
Jun 6 at 15:26
I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work
– cristobal
Jun 6 at 15:33
Yes,opensslis purely a TLS client, not an HTTP one. To mimick curl, try adding-alpn http/1.1. If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request:echo -n "GET / HTTP/1.1nHost: thirdparty.urlnnn" | openssl s_client ....or just type the request whens_clientstarted and until the connection remains open.
– Patrick Mevzek
Jun 6 at 15:41
The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
– cristobal
Jun 6 at 15:48
Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like ssllabs.com/ssltest
– Patrick Mevzek
Jul 5 at 17:44
 |Â
show 3 more comments
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I am running the following command:
curl --tlsv1.2 -v --cacert ./mycert.crt --key ./key.pem --cert ./mycert.crt https://thirdparty.url
I received the certificate from the third party I am working with after generating CSR and key files with openssl.
My server IP is whitelisted on the third party's firewall and they can see my requests coming in but the handshake always fails.
This is the response I receive:
* Trying X.X.X.X...
* Connected to thirdparty.url (X.X.X.X) port 443 (#0)
* found 1 certificates in ./nonprod.crt
* found 596 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Handshake failed
* Closing connection 0
curl: (35) gnutls_handshake() failed: Handshake failed
How can I debug this issue?
Some info:
I am running curl 7.47.0 on Ubuntu 16.04.4
I try running this command:
openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem
BUT I have to exclude the link URI to make it work. The response does include this however:
140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
140593823835800:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:656:
But it also says:
SSL handshake has read 3378 bytes and written 1702 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: CE2294E9B415FB8B9850DB28F64FEF17390A46D5A38F12E62E31F614DA4199CF50C0AFA5F62401C4964105AFC4F1B095
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1528299660
Timeout : 7200 (sec)
Verify return code: 0 (ok)
ubuntu curl ssl handshake gnutls
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
asked Jun 6 at 14:55
cristobal
12
I am running the following command:
curl --tlsv1.2 -v --cacert ./mycert.crt --key ./key.pem --cert ./mycert.crt https://thirdparty.url
I received the certificate from the third party I am working with after generating CSR and key files with openssl.
My server IP is whitelisted on the third party's firewall and they can see my requests coming in but the handshake always fails.
This is the response I receive:
* Trying X.X.X.X...
* Connected to thirdparty.url (X.X.X.X) port 443 (#0)
* found 1 certificates in ./nonprod.crt
* found 596 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Handshake failed
* Closing connection 0
curl: (35) gnutls_handshake() failed: Handshake failed
How can I debug this issue?
Some info:
I am running curl 7.47.0 on Ubuntu 16.04.4
I try running this command:
openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem
BUT I have to exclude the link URI to make it work. The response does include this however:
140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
140593823835800:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:656:
But it also says:
SSL handshake has read 3378 bytes and written 1702 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: CE2294E9B415FB8B9850DB28F64FEF17390A46D5A38F12E62E31F614DA4199CF50C0AFA5F62401C4964105AFC4F1B095
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1528299660
Timeout : 7200 (sec)
Verify return code: 0 (ok)
ubuntu curl ssl handshake gnutls
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
asked Jun 6 at 14:55
cristobal
12
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
edited Jun 6 at 17:03
Patrick Mevzek
2,0131721
2,0131721
asked Jun 6 at 14:55
cristobal
12
asked Jun 6 at 14:55
cristobal
12
asked Jun 6 at 14:55
cristobal
12
12
You can try withopenssl s_clientit should give you more debug information. Do not forger the-servernameparameter to enable TLS SNI proper negotiation
– Patrick Mevzek
Jun 6 at 15:26
I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work
– cristobal
Jun 6 at 15:33
Yes,opensslis purely a TLS client, not an HTTP one. To mimick curl, try adding-alpn http/1.1. If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request:echo -n "GET / HTTP/1.1nHost: thirdparty.urlnnn" | openssl s_client ....or just type the request whens_clientstarted and until the connection remains open.
– Patrick Mevzek
Jun 6 at 15:41
The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
– cristobal
Jun 6 at 15:48
Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like ssllabs.com/ssltest
– Patrick Mevzek
Jul 5 at 17:44
 |Â
show 3 more comments
You can try withopenssl s_clientit should give you more debug information. Do not forger the-servernameparameter to enable TLS SNI proper negotiation
– Patrick Mevzek
Jun 6 at 15:26
I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work
– cristobal
Jun 6 at 15:33
Yes,opensslis purely a TLS client, not an HTTP one. To mimick curl, try adding-alpn http/1.1. If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request:echo -n "GET / HTTP/1.1nHost: thirdparty.urlnnn" | openssl s_client ....or just type the request whens_clientstarted and until the connection remains open.
– Patrick Mevzek
Jun 6 at 15:41
The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
– cristobal
Jun 6 at 15:48
Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like ssllabs.com/ssltest
– Patrick Mevzek
Jul 5 at 17:44
You can try with
openssl s_client it should give you more debug information. Do not forger the -servername parameter to enable TLS SNI proper negotiation– Patrick Mevzek
Jun 6 at 15:26
You can try with
openssl s_client it should give you more debug information. Do not forger the -servername parameter to enable TLS SNI proper negotiation– Patrick Mevzek
Jun 6 at 15:26
I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work
– cristobal
Jun 6 at 15:33
I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work
– cristobal
Jun 6 at 15:33
Yes,
openssl is purely a TLS client, not an HTTP one. To mimick curl, try adding -alpn http/1.1 . If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request: echo -n "GET / HTTP/1.1nHost: thirdparty.urlnnn" | openssl s_client .... or just type the request when s_client started and until the connection remains open.– Patrick Mevzek
Jun 6 at 15:41
Yes,
openssl is purely a TLS client, not an HTTP one. To mimick curl, try adding -alpn http/1.1 . If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request: echo -n "GET / HTTP/1.1nHost: thirdparty.urlnnn" | openssl s_client .... or just type the request when s_client started and until the connection remains open.– Patrick Mevzek
Jun 6 at 15:41
The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
– cristobal
Jun 6 at 15:48
The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
– cristobal
Jun 6 at 15:48
Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like ssllabs.com/ssltest
– Patrick Mevzek
Jul 5 at 17:44
Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like ssllabs.com/ssltest
– Patrick Mevzek
Jul 5 at 17:44
 |Â
show 3 more comments
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f448228%2fgnutls-handshake-failed-why%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
You can try with
openssl s_clientit should give you more debug information. Do not forger the-servernameparameter to enable TLS SNI proper negotiation– Patrick Mevzek
Jun 6 at 15:26
I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work
– cristobal
Jun 6 at 15:33
Yes,
opensslis purely a TLS client, not an HTTP one. To mimick curl, try adding-alpn http/1.1. If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request:echo -n "GET / HTTP/1.1nHost: thirdparty.urlnnn" | openssl s_client ....or just type the request whens_clientstarted and until the connection remains open.– Patrick Mevzek
Jun 6 at 15:41
The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
– cristobal
Jun 6 at 15:48
Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like ssllabs.com/ssltest
– Patrick Mevzek
Jul 5 at 17:44