When testing a connection directly with openssl s_client and the handshake fails, OpenSSL typically reports a specific alert type in its output — reading it directly gives you a much more targeted starting point than the more generic errors browsers tend to surface.
Common alerts and what they mean
- handshake_failure — generally a protocol version or cipher suite mismatch
- unrecognized_name — an SNI-related issue, often the server not having a certificate configured for the exact hostname requested
- bad_certificate or certificate_unknown — a problem with the certificate itself, worth checking chain completeness and validity directly
Running the same command with a specific TLS version flag (-tls1_2, for example) helps further isolate whether the issue is protocol-version-specific or more fundamental to the certificate configuration itself.
What OpenSSL's specific handshake failure output typically reveals
OpenSSL's s_client output at the point of a handshake failure typically shows exactly which stage failed, cipher negotiation, certificate exchange, key exchange, giving considerably more diagnostic detail than a browser's generic error message alone would provide.
How to use this specific error as a starting point for the broader diagnostic playbook
A specific handshake failure identified through OpenSSL is exactly the kind of starting point our comprehensive OpenSSL diagnostic playbook is designed to build on — following that guide's systematic sequence from this specific failure point typically leads to a complete, confident diagnosis.
What the specific alert code in OpenSSL's output tells you about the failure's exact cause
TLS alert codes returned during a failed handshake (like handshake_failure, protocol_version, or insufficient_security) each correspond to a specific, documented reason for the failure — looking up the specific alert code shown in your OpenSSL output against TLS alert code documentation narrows down the exact cause considerably faster than generic troubleshooting.
How to compare a failing handshake against a known-working one for the same server
If the same server sometimes succeeds and sometimes fails, capturing OpenSSL's verbose output from both a successful and a failing attempt and comparing them side by side often reveals exactly which specific negotiation step differs between the two outcomes.
A final note on building a personal diagnostic library
Building a personal or team library of past handshake failures you've successfully diagnosed, along with their specific OpenSSL alert codes and resolutions, creates a genuinely valuable, searchable reference that speeds up diagnosing the next similar failure considerably faster than starting from scratch each time.
What the exact OpenSSL output looks like at the point of a typical handshake failure
OpenSSL's s_client output at a handshake failure point typically shows a specific TLS alert message just before the connection terminates, along with a verify return code — reading both together, rather than just noting that a failure occurred, usually identifies the specific stage and reason for the failure directly.
How to build a systematic testing sequence covering every stage of the handshake
Testing protocol version support, then cipher suite support, then certificate chain validity, then revocation status in sequence, using the individual techniques covered throughout our OpenSSL diagnostic playbook, builds a complete picture of exactly where in the handshake process a failure is actually occurring.
A quick closing checklist
A quick closing checklist covers reading the specific TLS alert code in OpenSSL's output, working through protocol, cipher, and chain checks systematically, and building a personal library of past failures and their resolutions for faster future diagnosis.
What role automated testing plays in catching a handshake regression before deployment
Incorporating a basic OpenSSL handshake test into your deployment pipeline, failing the deployment if a genuine handshake failure is detected, catches a configuration regression automatically before it ever reaches production, rather than relying solely on manual, post-deployment verification.