Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ECDH-ECDSA-AES128-SHA and some suggested that I should use the prime256v1 elliptic curves(I do not know what exactly does this means ) .I ;m using an apache tomcat server.My httpd-ssl-virtual-host-conf looks like this

ssl read bytes sslv3 alert handshake_failure

   Listen 4445
## SSL Virtual Host Context

Include "conf/httpd-jk.conf"
<VirtualHost *:4445>
#General setup for the virtual host
DocumentRoot "htdocs"
ErrorLog "logs/error_log"
TransferLog "logs/access_log"
CustomLog logs/car2x.log combined

#JKMount  /car2x/* worker1

JKMount  /BTS/* worker1
#<Location "/car2x/WEB-INF/">

<Location "/BTS/WEB-INF/">
   deny from all

JkMountCopy On

<Directory "htdocs">
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on
SSLProtocol -All +SSLv3 +TLSv1
#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list.
# This is only for allowed ciphers specified within the core service communication document
#SSLCipherSuite AES128-SHA

#SSLCertificateFile "conf/server-cert.pem"
#SSLCertificateFile "conf/resource/server-cert.pem"
SSLCertificateFile "conf/resource/Bucharest4.pem"

#SSLCertificateFile "conf/server-dsa.crt"

#SSLCertificateKeyFile "conf/server-key.pem"
#SSLCertificateKeyFile "conf/server-key.pem"
SSLCertificateKeyFile "conf/resource/Bucharest4_key.pem"

SSLCACertificateFile "conf/ca.pem"

SSLVerifyClient optional_no_ca

#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
SSLOptions +ExportCertData
#<FilesMatch "\.(cgi|shtml|phtml|php)$">
#    SSLOptions +StdEnvVars
<Directory "cgi-bin">
    SSLOptions +StdEnvVars

I'm getting the followinq error on the client side

D/https(1153): INFO TEXT: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

But when I'm trying to connect with openssl s_client -ciphers ECDH-ECDSA-AES-SHA -connect -k it works?

I can provide wireshark logs. In that logs I receive a lot of client hello but no server hello. Instead I receive sslv3 alert with number 40 (hanshake_failure).

share|improve this question
What version of openssl did you compile into your apache distribution and do you have any errors being written into your ssl_error log? – mahnsc Dec 11 '12 at 13:45
You might try to remove the ECDH ciphers when connecting with OpenSSL. I am facing a similar issue and removing these allowed to connect. I am still investigating the root cause. – user3880310 Jun 1 '15 at 17:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.