Unable to access a server with a self-signed SSL certificate from some devices

Question

I'm struggling to connect to an SSL site (self-signed certificate) that seems to work from other computers/internet connections. I've tried accessing the site using wget:

wget https://example.com --no-check-certificate
--2018-02-06 17:07:50--  https://example.com
Resolving example.com... xx.xx.xx.xx
Connecting to example.com|xx.xx.xx.xx|:443... connected.
Unable to establish SSL connection.

I then used Python3 and the requests module in another attempt:

>>> r = requests.get("https://example.com", verify=False)
Traceback (most recent call last):
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.5/site-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/usr/lib/python3.5/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 377, in wrap_socket
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 752, in __init__
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 988, in do_handshake
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 633, in do_handshake
ConnectionResetError: [Errno 104] Connection reset by peer

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.5/site-packages/requests/adapters.py", line 440, in send
    timeout=timeout
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 639, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3.5/site-packages/urllib3/util/retry.py", line 357, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/lib/python3.5/site-packages/urllib3/packages/six.py", line 685, in reraise
    raise value.with_traceback(tb)
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.5/site-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/usr/lib/python3.5/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 377, in wrap_socket
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 752, in __init__
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 988, in do_handshake
  File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 633, in do_handshake
urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.5/site-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3.5/site-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3.5/site-packages/requests/sessions.py", line 508, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.5/site-packages/requests/sessions.py", line 618, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.5/site-packages/requests/adapters.py", line 490, in send
    raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
>>>

I've then tried using openssl to see more detailed information:

# openssl s_client -connect example.com:443 -servername example.com
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 330 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1517926190
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

Running the same openssl command from a different computer (with a different internet connection), results in the following output:

# openssl s_client -connect example.com:443 -servername example.com
CONNECTED(00000003)
depth=0 CN = example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = example.com
verify return:1
---
Certificate chain
 0 s:/CN=example.com
   i:/CN=example.com
---
Server certificate
-----BEGIN CERTIFICATE-----
.
.
.
-----END CERTIFICATE-----
subject=/CN=example.com
issuer=/CN=example.com
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 706 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID: xxxxxx
    Session-ID-ctx:
    Master-Key: xxxxxx
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1517926278
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
closed

What could be causing the connection failure?

Answer 1

With two completely different results from two completely different connections I would assume the issue is DNS, make sure you are getting the same IP on both hosts. You may have a host file entry on one of these as well, so check for that.

Answer 2

It turns out that the problem was the ISP blocking certain top level domains. When the domain was accessed, their firewall returned HTTP response 503 and a HTML page indicating that the site was blocked. The problem was difficult to diagnose because the original site I'm trying to connect to uses SSL, and any error messages are brief and terse: "Unable to establish SSL connection", "Connection reset by peer" etc. Using wget to access the page also doesn't help because once it receives the 503 error, it simply exits without saving the resopnse HTML.

I ended up solving the problem by setting up a simple non-SSL HTTP web server using Python 3's http.server module on the server in question and then attempting to connect to it from a problematic device using the Python requests module. This allowed me to then see the content of the response and see the ISP's "page blocked" HTML page.