LightAtom

SSL Handshake Failed: Causes and Fixes

The client and server couldn't complete the TLS handshake that starts every HTTPS connection, because of a clock, protocol, certificate or interception problem.

SSL handshake failed

Before any data is exchanged, both sides agree on encryption and check the certificate. That negotiation failed, so no secure connection exists.

Quick checks

  • Check the device's date and time.
  • Try another browser and another network.
  • Pause VPNs, proxies and antivirus HTTPS scanning.

Fixes on Mac

  1. Fix the clock and update

    1. Turn on automatic time in System Settings › General › Date & Time.
    2. Install macOS and browser updates.

  2. Test the handshake from Terminal

    1. Run openssl s_client -connect example.com:443 -servername example.com.
    2. Errors like alert handshake failure or unable to get local issuer certificate name the cause.

  3. Remove interception

    1. Quit debugging proxies and security tools that inspect HTTPS; turn off unused proxies.

Fixes on Windows

  1. Update and clear SSL state

    1. Install updates; Internet Options › Content › Clear SSL state.

Other devices

  1. Apps and devices

    1. Update the app; old apps may only speak deprecated TLS versions.

Still not working?

Site owners, check in this order: the server supports TLS 1.2 and 1.3; it presents the full certificate chain; the certificate matches the requested host name (SNI); the cipher list includes modern AEAD ciphers. For client-certificate setups, the client must present a certificate the server trusts.

See what’s happening

LightAtom's connections view shows whether your browser connects to a proxy address instead of the site's servers, and which process runs that proxy.

Frequently asked questions

What does “SSL handshake failed” mean?

The initial TLS negotiation between client and server failed, so no encrypted connection was created. Nothing else could be sent.

Is it my device or the server?

If it fails for one site everywhere, it's the server. If it fails for many sites on your device, check the clock, proxies and security software.

How do I debug an SSL handshake on a Mac?

openssl s_client -connect host:443 -servername host shows the protocol, cipher, certificate chain and any alert. curl -v https://host shows the same from curl's view.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.