What happens if TLS handshake failed?

If the TLS handshake failed, it means the client's handshake could not proceed or the server's handshake did not respond.

In this scenario, your application may try to continue and fall over to using "http" rather than "https", which is a dangerous thing to do, as you might end up leaking data. To be absolutely sure that you will succeed with TLS, we need to perform additional security checks:

If the TLS handshake failed, then the application can trust the information in the URL, but it's hard to say anything about the body of the page (but it's definitely not safe to assume the page will contain sensitive data, like credit card numbers). In this case, if a login dialog pops up (like "sign up" or "forgot password"), it could prompt the user for credentials to proceed. If they enter the wrong credentials, then the application will be able to take advantage of that fact to bypass authentication later in the session. The server should probably redirect the user to a page where they can reset their password or other credentials, before showing a login form so they can't be reused.

If the TLS handshake succeeded, then you can trust the connection, and your application could access any resources on that website. However, you should ask yourself how much more you trust that specific website. It may contain pages that could steal or compromise your data, especially if a web application that runs as an extension of your browser like Facebook, Google, or Twitter is compromised and redirects your browser to a malicious website. You should think about how to improve the security of the website you are connecting to, both through SSL, if possible, and through other security measures like hashing passwords and storing sensitive data offline.

What if the certificate of the server is invalid? There are a lot of situations when a certificate cannot be trusted because its issuer has been revoked. Unfortunately, browsers like to show every certificate that is available, whether or not it is valid. There's nothing you can do about it. It's easy to fix by just clicking the "trusted" button.

What if my browser doesn't have the certificate? A lot of people don't install certificates in their browsers; they just use them in an older version of IE6 or another browser that doesn't support X.509 certificates. A big reason why this is happening is due to an incompatibility between Netscape Navigator 6.

What is TLS handshake failure while a client attempted to connect to?

We recently started receiving an odd TLS handshake error message in our ELK log.

For the first time in a long time we are seeing something that I'm not quite sure about, so I'd love to get some more thoughts on it.

The error was logged as follows: TLS handshake failure: TLSV1/SSLv3 protocol mismatch! (See ). What we found is that it seems to be happening with multiple clients. Clients from two different locations and of various versions were being hit. They're both Windows machines, so there's nothing specific to Windows OS. But they're using cURL 7.49.0 (same version as Apache's and other libraries.)

I can find no mention of this error in any of the many online sources, but I did find an older Curl post that mentions this, so it seems like this might be an old error message. Here is the actual log data: I don't have a specific client version I can get, but I did find a couple of different versions which I'll show below. But the question is, does anyone know what this error means or has it changed? We're seeing this from machines around the world at different times, so it's pretty hard to determine what could be going on in these machines. We have all our internal clients and firewalls in place so that shouldn't be the issue.

We use the ELK stack and have a lot of these messages in our logs. Since we only use cURL for all our internal communication (all internal clients are web based) I can't find the source of the error so I'm hoping you can point me in the right direction.

It's really not much code. Just reading the documentation seems to be enough to trigger it. But what I do know is this doesn't look normal, so it's likely a bug in Curl (or maybe a bug in the SSL library), but it seems hard to be sure since it doesn't seem to be reported as a TLS/SSL specific error code.

I've tried to follow the code carefully to determine where this error is coming from, but there's too many potential sources.