highIntermediateSymptom-first#tls#handshake#protocol#ssl#version

TLS handshake fails -- unsupported protocol version (SSLv3, TLS 1.0/1.1 disabled)

curl: (35) error:14094410:ssl routines:ssl3_read_bytes:sslv3 alert handshake failure

Likely source:connectivitysecurity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • curl: (35) error:14094410:ssl routines:ssl3_read_bytes:sslv3 alert handshake failure
  • openssl s_client returns 'no protocols available' or 'alert protocol version'
  • Browser shows ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • OpenSSL protocol negotiation output

    openssl s_client -connect <HOST>:<PORT> -brief 2>&1 | head -10

  • Server supported protocols

    nmap --script ssl-enum-ciphers -p <PORT> <HOST>

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • openssl s_client with -tls1 fails, but -tls1_2 works
  • nmap shows the server only supports TLS 1.2+

Confirm before fixing

openssl s_client -connect <HOST>:<PORT> -tls1_2 -brief 2>&1 | head -5
READ

Force TLS 1.2 to confirm the server accepts it

Fix

echo 'Upgrade the client library (OpenSSL, Java, etc.) to support TLS 1.2+.'
READ

Document the client upgrade

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
openssl s_client -connect <HOST>:<PORT> -brief 2>&1 | head -10
READ

Quick handshake test

2
nmap --script ssl-enum-ciphers -p <PORT> <HOST>
READ

Enumerate server TLS versions and ciphers

3
openssl s_client -connect <HOST>:<PORT> -tls1_2 -brief 2>&1 | head -5
READ

Force TLS 1.2 to test protocol compatibility

Prevention

  • Always test TLS compatibility before upgrading or downgrading protocol versions.
  • Use nmap ssl-enum-ciphers as a pre-deploy check for TLS configuration changes.
  • Maintain a compatibility matrix of client TLS capabilities for your user base.
  • Set minimum TLS 1.2 on servers and upgrade clients that cannot negotiate it.

Related runbooks

Same stack, same failure family — worth a skim.

TLS cipher/version mismatch -- legacy client cannot negotiate with modern servermedium

Old Java/Python client gets 'no cipher suites in common' error

NetworkingIntermediate2 causes
Open runbook
TLS hostname mismatch — certificate doesn't cover the namehigh

'SSL: certificate subject does not match hostname' in clients

TLS & PKIFoundation2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.