Applies to: HTTPS websites, APIs and mail servers; errors reproduced with OpenSSL 3.5.8 and curl 8.22.0 against Nginx 1.31.6
The TLS (SSL) handshake is the first step of an HTTPS connection: client and server agree on a protocol version and encryption, and the server proves its identity with its certificate. “Handshake failed” means they couldn’t agree, so no page data was sent. These are the causes we reproduced, with the messages you will see.
1. Protocol versions don’t match
A server that only allows TLS 1.3, contacted by a client limited to TLS 1.2:
curl: (35) TLS connect error: error:0A00042E:SSL routines::tlsv1 alert protocol version
Old clients (outdated Java, old phones, legacy software) often support only older versions. The usual server setting is TLS 1.2 and 1.3; in Nginx:
ssl_protocols TLSv1.2 TLSv1.3;
Test which versions a server accepts:
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null
2. HTTPS to a port that doesn’t speak TLS
curl: (35) TLS connect error: error:0A00010B:SSL routines::wrong version number
We got this by connecting with https:// to port 80. The same happens with a wrong port in an app or proxy, or with a mail client set to SSL/TLS on port 587 (which expects STARTTLS). See SMTP port numbers.
3. Certificate and key don’t belong together
Nginx refused to start with a certificate from one key pair and another private key:
SSL_CTX_use_PrivateKey("/k.pem") failed (SSL: error:05800074:x509 certificate routines::key values mismatch)
Compare the public keys; the two hashes must be identical:
openssl x509 -noout -pubkey -in certificate.crt | openssl sha256 openssl pkey -pubout -in private.key | openssl sha256
4. Certificate problems
An expired, self-signed or wrong-name certificate usually shows as “not trusted” rather than a handshake failure, for example SSL: certificate subject name 'lab.test' does not match target hostname. See SSL certificate not trusted: causes and fixes.
5. Behind Cloudflare: errors 525 and 526
- 525 SSL handshake failed: the handshake between Cloudflare and your server failed. Cloudflare lists as causes: no valid certificate on the server, port 443 not open, no SNI support, or cipher suites that don’t match.
- 526 Invalid SSL certificate: with the SSL mode Full (strict), Cloudflare can’t validate the certificate on your server. Install a valid certificate on the server.
Other causes to check
- The computer’s date and time are wrong.
- Antivirus software or a company firewall that inspects HTTPS.
- Several sites on one IP address, and a client that doesn’t send the site name (SNI): always test with
-servername.
Need a certificate? See our SSL certificates. Converting certificates for Windows: convert to PFX.
Official documentation: Cloudflare error 525.
