I'm trying to use OpenSSL to connect to an SSL server.

When I run:

openssl s_client -connect myhost.com:443

The following SSL client configurations work just fine:

  • Windows (OpenSSL 0.9.83e 23 Feb 2007)
  • Linux (OpenSSL 0.9.8o 01 Jun 2010)
  • Linux (OpenSSL 1.0.0-fips 29 Mar 2010)

Output from any successful connection looks like this:

New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
    Protocol  : TLSv1
    Cipher    : DES-CBC3-SHA
    Session-ID: (hidden)
    Master-Key: (hidden)
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1337266099
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

However, when I use client with my Ubuntu 12.04 (w/ OpenSSL 1.0.1 14 Mar 2012) I get error:

...:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:

How can I proceed on solving this?

All tips are much appreciated!

  • What protocol and cipher are used when it connects from Windows? May 15, 2012 at 22:30
  • It says: New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA. I wish I understood what this all means! :)
    – Jaakko
    May 16, 2012 at 5:37
  • DES? That's an odd cipher to have highest priority. What kind of server are you connecting to? May 16, 2012 at 5:51
  • 1
    Maybe the defaults on the newer openssl are by default restricting older ssl protocol versions? There would be some reasons to do so given the recent BEAST mess... May 17, 2012 at 13:41
  • 1
    D'oh, understood. You're testing the clients against your site.
    – brent
    May 17, 2012 at 15:07

3 Answers 3


This looks to be a known issue with Ubuntu's 1.0.1 OpenSSL: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/965371

It doesn't look like a fix is available. If possible you could downgrade to 1.0.0.

Try openssl s_client -tls1 -connect myhost.com:443

  • 1
    More details of the problem on the Debian ticket: bugs.debian.org/cgi-bin/bugreport.cgi?bug=665452
    – brent
    May 17, 2012 at 15:12
  • P.S. I will give you the bounty when it expires (19 hours)
    – Jaakko
    May 17, 2012 at 15:14
  • 2
    Sounds good :) Final piece of info, upstream ticket with OpenSSL that seems to be the root cause of the issue: rt.openssl.org/Ticket/…
    – brent
    May 17, 2012 at 15:16
  • Thanks! This answer also works for OpenSSL 0.9.8zh 14 Jan 2016 on Mac
    – tytk
    Jan 26, 2017 at 19:54

This error can be caused by an older version of openssl when it can not re-negotiate the cipher (I generated a self-signed certificate using elliptic curves).

Specifically, I was getting the same error on MacOS with default openssl - 0.9.8zh

After installing the brew version OpenSSL 1.0.2f the error went away:

~/bin/openssl s_client -connect localhost:45678 | grep Cipher

verify return:1
New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
  • after doing a brew install, my openssl version in /usr/bin/openssl was the old version. I had to specifically go to /usr/local/Cellar/openssl/1.0.2o_2/bin to run the latest version of openssl Jun 24, 2018 at 21:28

If you get this issue with a Java HTTPS server running on OpenJDK, try editing /etc/java-7-openjdk/security/java.security and commenting out the line

security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg

as discovered by Christoph W.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.