Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches.

~# curl -v
* About to connect() to port 443 (#0)
*   Trying
* connected
* Connected to ( port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
(hangs for a minute)
* Unknown SSL protocol error in connection to
* Closing connection #0
curl: (35) Unknown SSL protocol error in connection to

Now, when I add -1 (force tlsv1) or -3 (force sslv3) curl works flawlessly. The problem is that other programs seem to have similar issues, like python scripts.

When I try openssl it hangs like curl

openssl s_client  -connect

no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 320 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

The same happens if I use -tls1_2, but it works If I use -ssl3 switch

Additional Data:

OpenSSL> version
OpenSSL 1.0.1e 11 Feb 2013

Does anybody know how to fix this and make curl or openssl work with default settings? I have another machine with Debian lenny that can run both commands flawlessly without any switch.



share|improve this question
I have the same result as you with curl, wget works here though, what do you get with wget? – EightBitTony Jul 7 '13 at 8:16
@EightBitTony wget seems to work well, but also I discovered that other hosts work. curl works well without any switched but curl to will only work if I use curl -1 or -3 – Rodrigo Jul 7 '13 at 17:53
I wonder if it's something in the auto-detection of which SSL version to use that wget gets right and curl gets wrong? Anyway, out of my league, good luck! – EightBitTony Jul 7 '13 at 19:33
Same problem same site, I wonder if Dreamhost is aware – MattPark Dec 29 '14 at 19:08
up vote 2 down vote accepted

If you run this site against SSLLabs test, you'll see it's intolerant to long handshakes, a problem that certainly affects your version of OpenSSL.

Reducing the cipher list size should help, for example:

openssl s_client -cipher RSA -connect

(You can use the --ciphers option for curl.)

share|improve this answer

So I went ahead and filed a ticket with Dreamhost (Based on the analysis of @Bruno above) because I was having the same issue. It took a few weeks but they actually fixed it. Any other company they probably would have just put me in tech support hell.

share|improve this answer

Make sure you have the ca-certificates package installed properly. If it is installed, you may have accidentally deleted its files and need to reinstall it.

sudo apt-get install --reinstall ca-certificates
share|improve this answer
Still the same :/ keeps working when I use -1/-3 switch on curl, or -ssl3 switch for openssl command. – Rodrigo Jul 7 '13 at 5:27
The CA certificates are only used to verify the remote certificate. Unfortunately, there's no remote certificate presented here at all, so that wouldn't help ("no peer certificate available"). – Bruno Jul 9 '13 at 14:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.