We have been issued a EV certificate. The private key we used in the CSR is a EC key based on prime256v1. It was generated using the following command:

openssl ecparam -genkey -name prime256v1 -out foobar.com.key
openssl req -new -key foobar.com.key -out foobar.com.csr -subj /C=DE/ST=Foo/L=Bar/O=Fobbar Co/CN=foobar.com

Now the certificate got issued and we replaced the working Let's Encrypt certificate. It did not work but displayed the following error message:

140659019327128:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:769:

The server is Ubuntu Xenial. We tried all sorts of server ciphers, protocols, server cipher preferred or not, even all available ciphers did not work.

The testes clients were Chrome, Firefox, curl and openssl s_client on Ubuntu Xenial.

The second test was done with a fresh nginx installation without any changes to the Ubuntu defaults and no tinkering with ciphers or protocols. Still no luck.

Changing the key+cert to a standard Let's Encrypt cert works all the time.

What is the problem?

closed as too broad by Steffen Ullrich, StackzOfZtuff, Gilles, Serge Ballesta, Tobi Nary Mar 27 '18 at 11:33

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    There might be several configuration errors but almost nothing is known about your exact configuration. Therefore I propose to close the question as too broad. The only recommendation I have so far is too look at log files at the server and check for errors or warnings during startup which might point out configuration problems. You might also try to use cert and key together with openssl s_server to find out if they work at all and thus narrow down where the problem might be. – Steffen Ullrich Mar 20 '18 at 3:39
  • This is extremely unlikely to be due to EC vs RSA. It's probably due to something else about the certificate. This error message is not very informative (although someone might recognize the line number, but you'd need to specify the exact OpenSSL version). Chrome or Firefox's certificate display may be more informative. – Gilles Mar 20 '18 at 7:05
  • @SteffenUllrich I don't know why, but the key and the key the cert was requested with did not match, but nginx didn't show that, probably because the key was EC and the cert was requested with RSA. Thanks guys! – Phillipp Mar 22 '18 at 19:03

Browse other questions tagged or ask your own question.