We have been issued a EV certificate. The private key we used in the CSR is a EC key based on prime256v1. It was generated using the following command:
openssl ecparam -genkey -name prime256v1 -out foobar.com.key openssl req -new -key foobar.com.key -out foobar.com.csr -subj /C=DE/ST=Foo/L=Bar/O=Fobbar Co/CN=foobar.com
Now the certificate got issued and we replaced the working Let's Encrypt certificate. It did not work but displayed the following error message:
140659019327128:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:769:
The server is Ubuntu Xenial. We tried all sorts of server ciphers, protocols, server cipher preferred or not, even all available ciphers did not work.
The testes clients were Chrome, Firefox, curl and openssl s_client on Ubuntu Xenial.
The second test was done with a fresh nginx installation without any changes to the Ubuntu defaults and no tinkering with ciphers or protocols. Still no luck.
Changing the key+cert to a standard Let's Encrypt cert works all the time.
What is the problem?