[info] [‘TLS’, 32, ‘client’, 58, 32, 73, 110, 32, 115, 116, 97, 116, 101, 32, ‘certify’, 32, ‘at ssl_handshake.erl:364 generated CLIENT ALERT: Fatal - Internal Error - {unexpected_error,{case_clause,{error,{asn1,{…}}}}}’, 10]

This is a decoding error during the TLS handshake. The specific location (ssl_handshake.erl:364) suggests a certificate sent by the server cannot be parsed. Does openssl s_client -connect ******:443 -servername ****** connect without errors?

%HTTPoison.Error{id: nil, reason: :nxdomain}}

This suggests the hostname could not be resolved. I suspect you simply had a typo in the URL at the time, or there was a problem with your Internet connection.

In my current work, we have some concept similar to webhook and we need to support servers which might not follow the latest standard. Every time we try to upgrade erlang OTP, we will find some new errors which used to work in the old version. So we do the config change dance once again and settle on a config that works best across all the servers. Last time it was related to chacha20 cipher, which was enabled by default and there seem to be multiple incompatible implementations out there. Debugging these kind of errors are real tricky as the ssl app mostly throws a generic error without much details.

{:tls_alert, ‘internal error’}

This usually means something goes wrong when it tries to establish ssl connection. You could use SSL Server Test (Powered by Qualys SSL Labs) to figure out what kind of versions are supported by your target server. Then you can play around with ssl:connect/3

iex(1)> :ssl.start()
:ok
iex(2)> :ssl.connect('null.badssl.com', 443, [])

timestamp=2019-03-01T11:46:26.123Z level=info  message= ['TLS', 32, 'client', 58, 32, 73, 110, 32, 115, 116, 97, 116, 101, 32, 'hello', 32, 'received SERVER ALERT: Fatal - Handshake Failure', 10]
{:error, {:tls_alert, 'handshake failure'}}
iex(3)> :ssl.connect('google.com', 443, [])
{:ok,
 {:sslsocket, {:gen_tcp, #Port<0.19>, :tls_connection, :undefined},
  [#PID<0.438.0>, #PID<0.437.0>]}}

Once you find the correct set of options that allows you to connect, you
could pass that to hackney

HTTPoison.post(url, body, headers, ssl: [verify: :verify_none])