sslv3 alert handshake failure

Common causes

• No cipher suite or TLS version in common, typically an outdated client against a modern server, or the reverse.
• SNI missing, for example connecting by IP or with an old tool, so the server has no matching certificate to offer.
• The server requires a client certificate and none, or the wrong one, was sent.
• The server only has an ECDSA or RSA certificate type the client does not support.

How to fix it

1. Test with openssl s_client -connect host:443 -servername host and add -tls1_2 or -tls1_3 to find what works.
2. Update the client OpenSSL, language runtime or OS so it supports TLS 1.2 and 1.3 with modern ciphers.
3. If mutual TLS is required, pass the client certificate and key (curl --cert and --key).
4. Check which TLS versions and ciphers the server offers.