# Using HTTPS, TLSV1 fatal handshake
**URL:** https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592
**Category:** Support
**Created:** [May 29, 2017, 6:45pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592 "2017-05-29T18:45:40Z")
**Posts on this page:** 14
**Page:** 2
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 6, 2017, 7:31am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/21 "2017-06-06T07:31:32Z")
The template is already in my app.yml in the templates section.
Adding again and rebuilding app doesn’t change anything unfortunately.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 6, 2017, 10:54am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/22 "2017-06-06T10:54:14Z")
Paste templates section of app yml here
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 7, 2017, 9:24am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/23 "2017-06-07T09:24:11Z")
```
templates:
- "templates/postgres.template.yml"
- "templates/redis.template.yml"
- "templates/web.template.yml"
- "templates/web.ratelimited.template.yml"
## Uncomment these two lines if you wish to add Lets Encrypt (https)
- "templates/web.ssl.template.yml"
- "templates/web.letsencrypt.ssl.template.yml"
```
and my web.ssl.template.yml ssl\_ciphers was posted above
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 7, 2017, 2:29pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/24 "2017-06-07T14:29:57Z")
I don’t understand this, I explained that your templates should look like this:
```plaintext
templates:
- "templates/postgres.template.yml"
- "templates/redis.template.yml"
- "templates/web.template.yml"
- "templates/web.ratelimited.template.yml"
### this is new
- "containers/templates/web.ssl.template.yml"
### ^^^^
- "templates/web.letsencrypt.ssl.template.yml"
```
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 7, 2017, 2:34pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/25 "2017-06-07T14:34:23Z")
> [@gchiu](#):
>
> Android 2.3.7 No SNI 2 Server sent fatal alert: handshake\_failure
> [..]
> OpenSSL 0.9.8y Server sent fatal alert: handshake\_failure
Also…
Android 2.3.7 - Released December 6, 2010. An ancient BUGGY, INSECURE version of Android we do not support.
OpenSSL 0.9.8 - Released 11 Oct 2005, no longer supported by open ssl (1.0.2 and 1.1.0 are supported)
I don’t understand why you are even embarking on this.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 7, 2017, 7:25pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/26 "2017-06-07T19:25:27Z")
Yes and I added the `- "containers/templates/web.ssl.template.yml"` line to the above which made no difference to the outcome.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 7, 2017, 7:26pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/27 "2017-06-07T19:26:47Z")
> [@sam](#):
>
> I don’t understand why you are even embarking on this.
Because the scripting agent that I am using to add content to my discourse site doesn’t have ECDH ciphers.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 7, 2017, 7:30pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/28 "2017-06-07T19:30:49Z")
> [@gchiu](#):
>
> Yes and I added the - “containers/templates/web.ssl.template.yml” line to the above which made no difference to the outcome.
This does not make sense to me at all… there are three options here
1. You did not make any changes to `containers/templates/web.ssl.template.yml`
2. You did not run `./launcher rebuild app`
3. You also include `templates/web.ssl.template.yml` somewhere later which is overriding it.
Barring that you are going to have to link me to the FULL log of your rebuild and a FULL copy of app.yml and the web.ssl.template fork you are using, with passwords obsfucated.
> [@gchiu](#):
>
> Because the scripting agent that I am using to add content to my discourse site doesn’t have ECDH ciphers.
I think it is a better idea to upgrade you scripting agent here
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 10, 2017, 6:50am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/29 "2017-06-10T06:50:57Z")
I fired up a new Google Container VM and installed a completely new instance of discourse.
And get exactly the same result.
I’ll send the files you requested .. but which log is required?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 11, 2017, 2:18am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/30 "2017-06-11T02:18:33Z")
Its not fair, you keep moving goal posts here.
./launcher and bootstrap are working, the NGINX config is being placed in the container… you can tell that by doing
```plaintext
./launcher enter app
cd /etc/nginx
ls
... you can even edit the discourse.conf file and restart nginx with ...
sv restart nginx
```
So … somehow your config is not working with ancient Android 2.3.7 despite you “thinking” you made changes to add the support. I simply can not support you more here, its a futile exercise.
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 11, 2017, 6:37am UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/31 "2017-06-11T06:37:42Z")
> [@sam](#):
>
> So … somehow your config is not working with ancient Android 2.3.7 despite you “thinking” you made changes to add the support. I simply can not support you more here, its a futile exercise.
As I’ve said a few times, I’m using a scripting agent which doesn’t support the default cipher suites for TLS 1.0 which are specified by the ssl template.
It’s hardly futile at all.
I changed the ssl\_ciphers line in the `web.ssl.template.yml` to the one [here](https://github.com/discourse/discourse/blob/2fd1c49b88dcae814eef6244c01f3cca6f75cd49/config/nginx.sample.conf#L50) instead
and it now works as I wanted with an A+ report from ssllabs.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 11, 2017, 12:52pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/32 "2017-06-11T12:52:52Z")
Cool so this is working for you now, can we close this?
---
### Author:  [@gchiu](https://meta.discourse.org/u/gchiu)
#### Post date: [June 11, 2017, 6:00pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/33 "2017-06-11T18:00:43Z")
Yes, solved. And is there any particular reason why discourse doesn’t use the default ssl cipher settings for nginx?
> **[Configuring HTTPS servers](https://nginx.org/en/docs/http/configuring_https_servers.html)**
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 11, 2017, 6:26pm UTC](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592/34 "2017-06-11T18:26:51Z")
[Previous page](https://meta.discourse.org/t/using-https-tlsv1-fatal-handshake/63592.md?page=1)