HTTPS handshake error: Fatal - Handshake Failure

Still same error when calling the api… Do I have to look for the log?

When I run the following I get the TLS info.

curl -I -v --tlsv1.2 --tls-max 1.2 https://myserver/api/endpoint
*   Trying myserver-ip-address:443...
* Connected to myserver (myserver-ip-address) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: ~/ssl/cacert.pem
*  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384

What am I missing?

This is part of common options:

ssl: [
      ciphers:
        :ssl.cipher_suites(:all, :"tlsv1.2") ++
          [%{key_exchange: :rsa, cipher: :aes_256_cbc, mac: :sha256}],
       log_level: :all
    ],

I am new to Erlang and Elixir. Sorry for being noob. Can I know how to run that command?

Start ssl in verbose mode, then check what algorithm it is using for key exchange and cipher.

This still doesn’t help me to fix my handshake error.

config.exs

http_options: [
    timeout: 60_000,
    recv_timeout: 60_000,
    # ssl: [{:versions, [:"tlsv1.2"]}],
    ssl: [
      ciphers:
        :ssl.cipher_suites(:all, :"tlsv1.2") ++
          [%{key_exchange: :rsa, cipher: :aes_256_cbc, mac: :sha256}]
    ],
    log_level: :debug
    # hackney: [:insecure]
  ]

Error Log:

Request: POST /api/bill/payment
** (exit) an exception was raised:
    ** (HTTPoison.Error) {:tls_alert, 'handshake failure'}
        (httpoison) lib/httpoison.ex:66: HTTPoison.request!/5

Not sure what is wrong?

The server still on Erlang OTP 20 and not yet updated to latest version.

A little update: :ssl API have been changed, and correct code would be

:ssl.cipher_suites(:all, :"tlsv1.2") ++ [%{key_exchange: :rsa, cipher: :aes_256_cbc, mac: :sha256}]

just to add as a helper to debug these calls: :hackney_trace.enable(:max, :io) logs your requests to STDOUT on the REPL/console (it shows the enabled cipers for example).

Ah, of course, I had forgotten all about the removal of RSA key exchange already. One would expect a site such as this to support (EC)DHE: I mean, it is 2021…

Anyway, keep in mind that :ssl.cipher_suites/1,2 is deprecated. The ‘official’ way to select custom ciphers would be something like:

defaults = :ssl.cipher_suites(:default, :"tlsv1.2")
rsa_kx =
  :ssl.cipher_suites(:all, :"tlsv1.2")
  |> :ssl.filter_cipher_suites(
    key_exchange: &(&1 == :rsa),
    cipher: &(&1 in [:aes_128_cbc, :aes_128_gcm, :aes_256_cbc, :aes_256_gcm]),
  )
HTTPoison.get!("https://api.etrade.com", [], ssl: [ciphers: defaults ++ rsa_kx])

Also, and more importantly, as @Exadra37 pointed out, passing custom ssl options to Hackney/HTTPoison will override its secure defaults, including verify: :verify_peer and the CA trust store. So actually, for a secure connection you’d have to call:

HTTPoison.get!("https://api.etrade.com", [], ssl: [
  ciphers: defaults ++ rsa_kx,
  verify: :verify_peer,
  cacertfile: :certifi.cacertfile(),
  depth: 3,
  customize_hostname_check: [
    match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
  ]
])

It seems they’ve documented it here: Erlang -- ssl

• For security reasons RSA key exchange cipher suites are no longer supported by default, but can be configured. (OTP 21)

Glad to see your code is working again!

Excellent!

My code is working again. That’s a big relief. At first when the etrade API stopped working, I was worried that they had changed something fundamental in their OAUTH implementation that was going to involve some painstaking debugging. I’m having enough trouble finding time for this side project. I was dreading the thought at having to spend precious hours reworking code that had been working fine.

I guess that either the etrade admins stopped supporting some cipher I was using before or the erlang ssl stopped including some suites by default. Either way, your suggestion did the trick.

Thank you very much.