# Using HTTPS, TLSV1 fatal handshake
**URL:** https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592
**Category:** Support
**Created:** [May 29, 2017, 6:45pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592 "2017-05-29T18:45:40Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 29, 2017, 6:45pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/1 "2017-05-29T18:45:40Z")
I implemented https using this walkthrough, and browser clients get https.
There are no errors in the logs as above
But at least one person says that they can’t login anymore. And my scripting agent can no longer read the pages ( though it’s able to read [https://meta.discourse.org](https://meta.discourse.org) and [https://letsencrypt.org/](https://letsencrypt.org/) with no problems).
I’m getting a TLSV1 fatal handshake failure showing in wireshark.
Can someone decode the [ssllabs report](https://www.ssllabs.com/ssltest/analyze.html?d=forum.rebol.info) to let me know what the issue is.
I’m also seeing handshake failures there too
```
Handshake Simulation
Android 2.3.7 No SNI 2 Server sent fatal alert: handshake_failure
[..]
OpenSSL 0.9.8y Server sent fatal alert: handshake_failure
```
As an alternative, can I just turn off the redirect from http to https?
Perhaps by commenting out [discourse\_docker/templates/web.ssl.template.yml at master · discourse/discourse\_docker · GitHub](https://github.com/discourse/discourse_docker/blob/master/templates/web.ssl.template.yml#L6-L14)
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 29, 2017, 10:07pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/2 "2017-05-29T22:07:07Z")
Are you able to provide a reproducible test case? The description of your error is vague and unhelpful. Is your scripting agent running OpenSSL 0.9.8y or Android 2.3.7?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [May 29, 2017, 10:28pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/3 "2017-05-29T22:28:26Z")
You followed the let’s encrypt instructions?
forum.rebol.info works fine if you access https. Http doesn’t respond, somehow.
The link you provide gives the site an A+ rating.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 29, 2017, 11:22pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/4 "2017-05-29T23:22:22Z")
Yeah, I disabled the redirect I thought but the site no longer works with http ☹
And, yes, I see the A+ rating but I also see fatal handshake errors in the report and I think that’s what is killing my scripting client.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 29, 2017, 11:45pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/5 "2017-05-29T23:45:42Z")
> [@Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/set-up-https-support-with-lets-encrypt/40709/303):
>
> I disabled the redirect I thought but the site no longer works with http
That’s probably HSTS getting in the way.
> [@Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/set-up-https-support-with-lets-encrypt/40709/303):
>
> I also see fatal handshake errors in the report and I think that’s what is killing my scripting client.
Why? Is your scripting client using OpenSSL 0.9.8y, or running on Android 2.3.7?
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 30, 2017, 1:19am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/6 "2017-05-30T01:19:12Z")
> [@Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/set-up-https-support-with-lets-encrypt/40709/304):
>
> > [@Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/set-up-https-support-with-lets-encrypt/40709/303):
> >
> > I also see fatal handshake errors in the report and I think that’s what is killing my scripting client.
>
> Why? Is your scripting client using OpenSSL 0.9.8y, or running on Android 2.3.7?
It’s using open source encryption software dated 2007. So, it may well be a bit out of date ☹
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 30, 2017, 1:50am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/7 "2017-05-30T01:50:43Z")
The SSL Labs report indicates that TLS v1.0 is enabled. That standard was published [in 1999](https://www.ietf.org/rfc/rfc2246.txt). If your scripting client doesn’t support at least TLS v1.0, you _really_ need to upgrade it, and if it does, then you’re OK. It’s possible that none of the available cipher suites are ones your scripting client supports, but in that case, again, you probably want to upgrade your scripting client, because everything else is pretty nasty.
Once again, though, I’m only guessing, because you’re providing very vague answers, rather than anything concrete.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 30, 2017, 2:57am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/8 "2017-05-30T02:57:46Z")
Well, it’s an open source product so if it can be fixed, then we will try.
So, here’s our discussion of the issue [here](http://chat.stackoverflow.com/transcript/message/37338265#37338265)
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 30, 2017, 7:01pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/9 "2017-05-30T19:01:41Z")
Are there other discourse sites using Letsencrypt that I can check against to see if it’s a configuration issue on our side that is breaking us.
This site and letsencrypt itself can be read by our scripting agent.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [May 30, 2017, 7:02pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/10 "2017-05-30T19:02:52Z")
Try this one:
> **[Let's Encrypt Community Support](https://community.letsencrypt.org/)**
>
> Let's Encrypt Community Support
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 30, 2017, 7:06pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/11 "2017-05-30T19:06:55Z")
That one reads fine!
The thought is that
> “our discourse server” only supports TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA or TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, while rebol only supports [these](https://github.com/metaeducation/ren-c/blob/master/src/mezz/prot-tls.r#L23)
So, if I can change the cipher suite to one rebol supports, then we’ll also be suite.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 30, 2017, 7:29pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/12 "2017-05-30T19:29:20Z")
I ran the ssllabs report on `https://community.letsencrypt.org` and it supports for TLS 1.0
```
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp256r1 (eq. 3072 bits RSA) FS 128
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) DH 2048 bits FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp256r1 (eq. 3072 bits RSA) FS 256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) DH 2048 bits FS
```
So, I guess I need to find out how I can configure the support for `TLS_DHE_RSA_WITH_AES_128_CBC_SHA` which we have
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 30, 2017, 11:00pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/13 "2017-05-30T23:00:17Z")
The cipher suite settings appear to be [here](https://github.com/discourse/discourse_docker/blob/master/templates/web.ssl.template.yml#L22)
`ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA;`
So, I have tried to put in `TLS-DHE-RSA-WITH-AES-256-CBC-SHA` but I’ve run out of disk space so can’t commit the changes. ☹
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 31, 2017, 6:12am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/14 "2017-05-31T06:12:47Z")
I resized the disk and rebuilt but it hasn’t changed the cipher suites available.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 31, 2017, 6:26pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/15 "2017-05-31T18:26:48Z")
The chaps at [https://community.letsencrypt.org/](https://community.letsencrypt.org/) tell me they use a discourse hosted instance so don’t know what their SSL template `web.ssl.template.yml` says.
Would anyone here know?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [May 31, 2017, 7:07pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/16 "2017-05-31T19:07:35Z")
> [@gchiu](#):
>
> but I’ve run out of disk space so can’t commit the changes.
Run `./launcher cleanup` and `sudo apt clean`
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 31, 2017, 9:01pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/17 "2017-05-31T21:01:42Z")
Thanks. I’ll give that a go but in the meantime I’ve increased the disk size
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [May 31, 2017, 11:05pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/18 "2017-05-31T23:05:22Z")
> [@riking](#):
>
> Run `./launcher cleanup`
Nice, that doubled the amount of free space I had.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 4, 2017, 12:38am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/19 "2017-06-04T00:38:54Z")
>
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 5, 2017, 3:02pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/20 "2017-06-05T15:02:24Z")
1. `mkdir -p containers/templates` (this is not in source control)
2. `cp templates/web.ssl.template.yml containers/templates`
3. fuss with the file
4. add `containers/templates/web.ssl.template.yml` to you `app.yml` file in the `templates` section
5. profit
[Next page](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592.md?page=2)