0

I do have a Windows 10 Machine that is not connecting to some sites.

I do get error like:

Firefox:

Secure Connection Failed

Chrome:

ERR_CONNECTION_CLOSED

Edge:

Can’t connect securely to this page

The errors are intermittent, sometimes with a reboot it will start working, but after a while it stops working again (not always on the same site).

At first I thought it could be the internet connection, the server, my network...

So I tested in different computers and even a virtual machine with this windows host and it does work. So I started to suspect of Windows itself.

It stopped working on a specific website (my website), so I got a lot more info to debug.

Checking my frontend log (nginx) I got:

[crit] 2679#2679: *444 SSL_do_handshake() failed (SSL: error:1417D102:SSL routines:tls_process_client_hello:unsupported protocol) while SSL handshaking,

Ok, in my server I only support TLS 1.2. And the connection is using probably a lower, why? The browsers are updated (I always tested in more then one).

So I went back to my Windows box and used Wireshark to check the packets.

I could see, that my windows are always trying to make a TLS 1.0 connection to some websites and it's send a cipher list not supported by the server.

Ok, that's why the handshake failed.

But why is it trying to use TLS 1.0.

I went to Firefox, about:config and changed the security.tls.version.min to 3 (TLS 1.2).

I tried everything I could in Firefox and chrome. But nothing changed.

I also tried changing windows registry, to totally disable TLS 1.0 and 1.1.

But no matters what I do, I always see a TLS 1.0 connection in wireshark in the websites I do fail.

And yes, my website it's configured properly. There are major sites that I got the same error, like gitlab.com.

Checking in the web, I found several bug in Windows about TLS 1.2, some major bugs that stopped the rollout of some versions. But Microsoft claim it was fixed inKB4458166.

Does any one have any clue or suggestion what I could do? It's very annoying. Because some day it work and some day it does not work.

I'm pretty sure it's a Windows bug. But i'm stuck.

0

Windows 10 support all 3 versions (1.0, 1.1 and 1.2). But to use them, make sure they are enabled in IE --> Tools --> Internet Options --> advanced.

Try disabling all and re-enabling all of them to refresh some potential problems.

Your error means that the client tried to connect using a specific SSL protocol while you explicitly forbid it. Make sure also that all SSL versions used for the communications are enabled, but note that SSL 2.0 and 3.0 have been deprecated by the IETF (in 2011 and 2015, respectively. You should no longer use them.

Also note that SSL 2 was not inter-operable with v3, and SSL v3 not inter-operable with TLS v1.

So basically, you should make sure SSL is no longer used, and go TLS only.

  • It's enable not all websites show the problem. – Thiago Souza Mar 21 at 13:37
  • What about SSLv3 ? I've updated the answer. – Overmind Mar 21 at 13:40
  • It's enable only TLS 1.2 in my Windows. – Thiago Souza Mar 21 at 13:59
  • Have you tried forcing WinHTTP to use 1.2 as per the bottom of support.microsoft.com/en-my/help/3140245/… set DWORD DefaultSecureProtocols value of 0x00000800 under: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp – HelpingHand Apr 15 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.